pyload-ng has 38 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 9 in the last 90 days against 3 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 7.5 (high), with 4 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 3
Worst active — by depth score
CVE-2024-22416Critical· 9.6Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation65CVE-2024-21644High· 7.5pyload Unauthenticated Flask Configuration Leakage vulnerability62CVE-2025-54802Critical· 9.8pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)54CVE-2025-53890Critical· 9.8pyLoad vulnerable to XSS through insecure CAPTCHA 54CVE-2024-32880Critical· 9.1pyLoad allows upload to arbitrary folder lead to RCE50
pyload-ng vulnerabilities
CVEs affecting pyload-ng, newest first. Open any entry for full detail, references, and exploit status.
38 CVEsRSS
CVE-2024-21645Medium· 5.3PoCpyload Log Injection vulnerability
pyload Log Injection vulnerability
CVE-2023-47890High· 7.6Download to arbitrary folder can lead to RCE
Download to arbitrary folder can lead to RCE
CVE-2023-0488Medium· 5.4Cross-site Scripting in pyload-ng
Cross-site Scripting in pyload-ng
CVE-2023-0509High· 7.4Improper Certificate Validation in pyload-ng
Improper Certificate Validation in pyload-ng
CVE-2023-0434Medium· 5.4Improper Input Validation in pyload-ng
Improper Input Validation in pyload-ng
CVE-2023-0227Medium· 6.5Pyload Insufficient Session Expiration vulnerability
Pyload Insufficient Session Expiration vulnerability
CVE-2023-0055Medium· 5.3Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CVE-2023-0057Medium· 6.1pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames