Vulnerabilidades en pyload
53 resultadosCVE-2026-35459CRITICALpyLoad has SSRF fix bypass via HTTP redirectEPSS 0.3%CVE-2026-35187HIGHpyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterEPSS 0.3%CVE-2026-35592MEDIUMpyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix BypassEPSS 0.3%CVE-2026-123813HIGHpyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionEPSS 0.3%CVE-2026-45306MEDIUMpyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session DirectoryEPSS 0.2%CVE-2026-40071MEDIUMpyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actionsEPSS 0.2%CVE-2026-45348HIGHpyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalEPSS 0.2%CVE-2026-33314MEDIUMpyload-ng: Improper Authentication and Origin Validation ErrorEPSS 0.2%CVE-2026-46561MEDIUMpyLoad: SSRF via HTTP Redirect Bypass in parse_urls APIEPSS 0.2%CVE-2026-42312MEDIUMpyload-ng: non-admin SETTINGS users can disable outbound TLS peer verificationEPSS 0.2%CVE-2026-40594MEDIUMpyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)EPSS 0.2%CVE-2026-35586MEDIUMAuthorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ngEPSS 0.1%CVE-2026-123814MEDIUMpyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostEPSS 0.1%