CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42312

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 5.5%

CVSS Severity

CVSS v3 Score 6.8

References

Products affected by CVE-2026-42312

Pyload-Ng Project » Pyload-Ng » Version: N/A

cpe:2.3:a:pyload-ng_project:pyload-ng:-
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev528

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev528
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev532

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev532
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev535

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev535
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev536

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev536
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev537

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev537
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev539

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev539
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev540

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev540
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev545

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev545
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev562

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev562
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev564

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev564
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a5.dev565

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a5.dev565
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a6.dev570

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a6.dev570
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a6.dev578

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a6.dev578
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a6.dev587

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a6.dev587
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a7.dev596

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a7.dev596
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a8.dev602

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a8.dev602
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev615

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev615
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev629

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev629
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev632

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev632
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev641

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev641
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev643

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev643
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev655

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev655
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0a9.dev806

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0a9.dev806
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b1.dev1

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b1.dev1
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b1.dev2

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b1.dev2
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b1.dev3

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b1.dev3
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b1.dev4

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b1.dev4
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b1.dev5

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b1.dev5
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b2.dev10

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b2.dev10
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b2.dev11

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b2.dev11
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b2.dev12

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b2.dev12
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b2.dev9

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b2.dev9
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev13

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev13
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev14

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev14
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev17

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev17
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev18

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev18
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev19

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev19
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev20

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev20
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev21

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev21
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev22

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev22
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev24

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev24
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev26

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev26
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev27

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev27
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev28

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev28
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev29

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev29
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev30

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev30
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev31

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev31
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev32

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev32
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev33

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev33
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev34

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev34
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev35

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev35
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev38

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev38
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev39

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev39
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev40

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev40
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev41

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev41
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev42

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev42
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev43

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev43
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev44

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev44
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev45

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev45
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev46

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev46
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev47

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev47
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev48

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev48
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev49

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev49
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev50

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev50
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev51

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev51
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev52

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev52
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev53

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev53
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev54

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev54
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev57

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev57
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev60

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev60
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev62

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev62
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev64

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev64
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev65

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev65
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev66

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev66
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev67

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev67
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev68

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev68
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev69

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev69
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev70

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev70
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev71

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev71
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev72

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev72
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev73

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev73
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev74

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev74
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev75

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev75
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev76

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev76
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev77

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev77
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev78

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev78
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev79

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev79
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev80

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev80
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev81

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev81
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev82

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev82
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev85

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev85
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev87

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev87
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev88

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev88
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev89

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev89
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev90

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev90
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev91

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev91
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev92

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev92
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev93

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev93
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev94

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev94
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev95

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev95
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev96

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev96
Pyload-Ng Project » Pyload-Ng » Version: 0.5.0b3.dev97

cpe:2.3:a:pyload-ng_project:pyload-ng:0.5.0b3.dev97

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42312

Products

Pricing

Contact Us