These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-46561 is a Server-Side Request Forgery (SSRF) vulnerability in pyLoad, a free and open-source Python download manager. The flaw exists in versions prior to 0.5.0b3.dev100, where the PREREQFUNCTION-based private IP address validation was not applied to HTTPRequest, which is used by the parse_urls API. An authenticated attacker can exploit this by supplying a URL pointing to an attacker-controlled [truncated]
A stored cross-site scripting (XSS) vulnerability exists in pyLoad, a free and open-source Python download manager. Prior to version 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML without escaping, then writes the result to the DOM via $(div).html(html). An attacker [truncated]
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, but does NOT protect the Flask session directory (/tmp/pyLoad/flask). An authenticated attacker can set storage_folder to the session directory and download session files of other users via /files/get/, leading to account takeove [truncated]
CVE-2026-44226 is an unauthenticated information-disclosure issue in pyLoad/pyload-ng WebUI. If the WebUI is reachable, an attacker can trigger an unhandled exception through the unauthenticated /web/<path:filename> route and receive full Python traceback details in the HTTP response. The issue is fixed in 0.5.0b3.dev100.
A critical server-side request forgery (SSRF) vulnerability was found in Pyload-Ng, a free and open-source download manager written in Python. The vulnerability exists in versions 0.5.0b3.dev96 and earlier. An authenticated user with ADD permission can bypass the SSRF fix by submitting a URL that redirects to an internal address. This vulnerability allows attackers to potentially access internal resources [truncated]
CVE-2026-35187 is a server-side request forgery vulnerability in pyLoad, a free and open-source download manager written in Python. The vulnerability exists in the parse_urls API function in src/pyload/core/api/__init__.py, which fetches arbitrary URLs server-side via get_url(url) (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can make [truncated]