pyload
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 31 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 4, 2023 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
pyLoad has an authentication bypass in API key validation (check_apikey cache)
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions
pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution
pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Monitor pyload in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.