Patchfirst
Patchfirst
ChainpyloadPyPI:pyload-ng

pyload: incomplete fixes (2026)

7 CVEs over 3 generations, 24 Mar 2026 to 28 May 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2026-3350924 Mar 2026 First in the chain
  2. CVE-2026-354637 Apr 2026 No direct link to an earlier CVE
  3. CVE-2026-354647 Apr 2026 related to CVE-2026-33509
  4. CVE-2026-355867 Apr 2026 No direct link to an earlier CVE
  5. CVE-2026-4231211 May 2026 related to CVE-2026-33509related to CVE-2026-35463and 2 more
  6. CVE-2026-4231311 May 2026 related to CVE-2026-33509related to CVE-2026-35463and 2 more
  7. CVE-2026-4530628 May 2026 incomplete fix for CVE-2026-33509
Mar 2026AprMay CVE-2026-33509 → CVE-2026-35464: related (high confidence)CVE-2026-33509 → CVE-2026-42312: related (high confidence)CVE-2026-33509 → CVE-2026-42313: related (high confidence)CVE-2026-33509 → CVE-2026-45306: incomplete fix (high confidence)CVE-2026-35463 → CVE-2026-42312: related (high confidence)CVE-2026-35463 → CVE-2026-42313: related (high confidence)CVE-2026-35464 → CVE-2026-42312: related (high confidence)CVE-2026-35464 → CVE-2026-42313: related (high confidence)CVE-2026-35586 → CVE-2026-42312: related (high confidence)CVE-2026-35586 → CVE-2026-42313: related (high confidence) CVE-2026-33509 24 Mar 2026 CVE-2026-35463 7 Apr 2026 CVE-2026-35464 7 Apr 2026 CVE-2026-35586 7 Apr 2026 CVE-2026-42312 11 May 2026 CVE-2026-42313 11 May 2026 CVE-2026-45306 28 May 2026 Mar 2026AprMay CVE-2026-33509 → CVE-2026-35464: related (high confidence)CVE-2026-33509 → CVE-2026-42312: related (high confidence)CVE-2026-33509 → CVE-2026-42313: related (high confidence)CVE-2026-33509 → CVE-2026-45306: incomplete fix (high confidence)CVE-2026-35463 → CVE-2026-42312: related (high confidence)CVE-2026-35463 → CVE-2026-42313: related (high confidence)CVE-2026-35464 → CVE-2026-42312: related (high confidence)CVE-2026-35464 → CVE-2026-42313: related (high confidence)CVE-2026-35586 → CVE-2026-42312: related (high confidence)CVE-2026-35586 → CVE-2026-42313: related (high confidence) CVE-2026-33509 24 Mar 2026 CVE-2026-35463 7 Apr 2026 CVE-2026-35464 7 Apr 2026 CVE-2026-35586 7 Apr 2026 CVE-2026-42312 11 May 2026 CVE-2026-42313 11 May 2026 CVE-2026-45306 28 May 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2026-33509 24 Mar 2026 pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration First in chain 14.4
CVE-2026-35463 7 Apr 2026 pyLoad has Improper Neutralization of Special Elements used in an OS Command First in chain 17.6
CVE-2026-35464 7 Apr 2026 pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask… CVE-2026-33509 · related · High 14.2
CVE-2026-35586 7 Apr 2026 Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng First in chain 5.5
CVE-2026-42312 11 May 2026 pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification CVE-2026-33509 · related · High 6.1
CVE-2026-42313 11 May 2026 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy CVE-2026-33509 · related · High 12.6
CVE-2026-45306 28 May 2026 pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory CVE-2026-33509 · incomplete fix · High 7.4
↑ ↓ chooseEnter openEsc close