# pyLoad vulnerabilities Source: https://junglewise.ai/threats/vendors/pyload Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/pyload.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in pyLoad: 2 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123816, was published on 9 November 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 3 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 2 - Last 90 days: 10 - All time: 33 (3 critical, 0 exploited in the wild) ## About pyLoad The developer of pyLoad, an open-source download manager written in Python. ## Latest pyLoad vulnerabilities - [CVE-2026-123816: pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in) (high, CVSS 8.1, published 9 Nov 2026) - [CVE-2026-123814: pyLoad WindowsPhoneNotify SSRF in notification addon](https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in) (medium, CVSS 6.4, published 9 Nov 2026) - [CVE-2026-75597: pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses) (medium, CVSS 5.3, published 9 Oct 2026) - [CVE-2026-48484: pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service) (medium, CVSS 6.5, published 9 Oct 2026) - [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12) (medium, published 9 Oct 2026) - [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba) (high, CVSS 7.5, published 9 Oct 2026) - [pyLoad API.set_user_permission session invalidation bypass](https://junglewise.ai/threats/pyload-api-set-user-permission-never-invalidates-the-target-s-session-9c452634) (high, CVSS 7.5, published 9 Oct 2026) - [pyLoad WindowsPhoneNotify addon SSRF via unguarded http.client](https://junglewise.ai/threats/pyload-windowsphonenotify-addon-non-admin-settings-user-triggers-ssrf-4450ab47) (medium, CVSS 6.4, published 9 Oct 2026) - [CVE-2026-48987: pyLoad uncontrolled memory growth in EventManager](https://junglewise.ai/threats/cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-48737: pyLoad pyload-ng SSRF bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers) (medium, CVSS 4.9, published 15 Sep 2026) - [CVE-2026-46561: pyLoad SSRF via HTTP redirect bypass in parse_urls API](https://junglewise.ai/threats/cve-2026-46561-pyload-ssrf-via-http-redirect-bypass-in-parse-urls-api) (medium, CVSS 5, published 28 May 2026) - [CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template](https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template) (high, CVSS 8.7, published 28 May 2026) - [CVE-2026-45306: pyLoad account takeover via session directory bypass in storage_folder](https://junglewise.ai/threats/cve-2026-45306-pyload-account-takeover-via-session-directory-bypass-in-storage) (medium, CVSS 6.5, published 28 May 2026) - [CVE-2026-44226: pyLoad pyload-ng information disclosure in WebUI error handler](https://junglewise.ai/threats/cve-2026-44226-pyload-pyload-ng-information-disclosure-in-webui-error-handler) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-42314: pyLoad path traversal in package folder name sanitization](https://junglewise.ai/threats/cve-2026-42314-pyload-path-traversal-in-package-folder-name-sanitization) (medium, CVSS 6.5, published 11 May 2026) - [CVE-2026-42313: pyLoad incorrect authorization in proxy configuration settings](https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings) (high, CVSS 8.3, published 11 May 2026) - [CVE-2026-42312: pyLoad improper authorization allows disabling TLS verification](https://junglewise.ai/threats/cve-2026-42312-pyload-improper-authorization-allows-disabling-tls-verification) (medium, CVSS 6.8, published 11 May 2026) - [CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)](https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change) (high, CVSS 8.8, published 22 Apr 2026) - [CVE-2026-40594: pyLoad session cookie security downgrade via header spoofing](https://junglewise.ai/threats/cve-2026-40594-pyload-session-cookie-security-downgrade-via-header-spoofing) (medium, CVSS 4.8, published 21 Apr 2026) - [pyLoad insufficient session expiration after permission changes](https://junglewise.ai/threats/pyload-insufficient-session-expiration-after-permission-changes-b01d3381) (low, CVSS 2.9, published 14 Apr 2026) - [CVE-2026-40071: pyload-ng improper authorization in WebUI JSON endpoints](https://junglewise.ai/threats/cve-2026-40071-pyload-ng-improper-authorization-in-webui-json-endpoints) (medium, CVSS 5.4, published 8 Apr 2026) - [CVE-2026-35592: pyload-ng path traversal in UnTar extraction](https://junglewise.ai/threats/cve-2026-35592-pyload-ng-path-traversal-in-untar-extraction) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-35586: pyload-ng authorization bypass in SSL configuration](https://junglewise.ai/threats/cve-2026-35586-pyload-ng-authorization-bypass-in-ssl-configuration) (medium, CVSS 6.8, published 8 Apr 2026) - [CVE-2026-35459: pyLoad SSRF via HTTP redirect bypass in BaseDownloader](https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader) (critical, CVSS 9.1, published 6 Apr 2026) ## Most severe pyLoad vulnerabilities - [CVE-2024-22416: pyLoad pyload-ng CSRF leading to admin privilege escalation](https://junglewise.ai/threats/cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation) (critical, CVSS 9.6, published 19 Jan 2024) - [CVE-2024-47821: pyLoad remote code execution via flashgot API and scripts folder manipulation](https://junglewise.ai/threats/cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder) (critical, CVSS 9.1, published 28 Oct 2024) - [CVE-2026-35459: pyLoad SSRF via HTTP redirect bypass in BaseDownloader](https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader) (critical, CVSS 9.1, published 6 Apr 2026) - [CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)](https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change) (high, CVSS 8.8, published 22 Apr 2026) - [CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template](https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template) (high, CVSS 8.7, published 28 May 2026) - [CVE-2026-42313: pyLoad incorrect authorization in proxy configuration settings](https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings) (high, CVSS 8.3, published 11 May 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-123816: pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in) (high, CVSS 8.1, published 9 Nov 2026) - [CVE-2026-35187: pyLoad SSRF and local file disclosure in parse_urls API](https://junglewise.ai/threats/cve-2026-35187-pyload-ssrf-and-local-file-disclosure-in-parse-urls-api) (high, CVSS 7.7, published 6 Apr 2026) - [CVE-2025-7346: pyLoad authentication bypass via Host header spoofing in local_check](https://junglewise.ai/threats/cve-2025-7346-pyload-authentication-bypass-via-host-header-spoofing-in-local) (high, CVSS 7.5, published 8 Jul 2025) ## Vulnerabilities per week Nothing in the last four weeks, down from 8 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## pyLoad technologies - [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation): 22 vulnerabilities - [pyLoad](https://junglewise.ai/threats/technologies/pyload): 13 vulnerabilities - [pyLoad Next Gen](https://junglewise.ai/threats/technologies/pyload-next-gen): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pyLoad vulnerabilities", https://junglewise.ai/threats/vendors/pyload, 12 November 2026.