Alta
ghsa-68w4-83fh-f2w8
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 58
Restablecer filtros
Media
ghsa-9q47-3cm2-2rp8
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
Alta
ghsa-jq7h-wrvp-3rgx
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
Alta
ghsa-889w-m37p-88m5
pyLoad: Api.set_user_permission never invalidates the target's session
Media
ghsa-p3pr-8f3m-4qp8
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
Alta
ghsa-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
Alta
ghsa-r44w-v6gf-x3p6
pyLoad has an authentication bypass in API key validation (check_apikey cache)
Media
CVE-2026-75597
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
Media
CVE-2026-48484
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
Media
CVE-2026-48737
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Media
CVE-2026-48987
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
Media
CVE-2026-46561
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Alta
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Media
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Media
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Alta
CVE-2026-41133
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Media
CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
Alta
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Alta
CVE-2026-35187
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Alta
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Alta
CVE-2025-61773
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
Alta
CVE-2025-57751
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Alta
CVE-2025-55156
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Alta
CVE-2025-54140
`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.