Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33511 Unauthenticated Remote Access Bypass in pyLoad Download Manager via Host Header Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33511
Post summary
A new unauthenticated remote‑access bypass vulnerability (CVE‑2026‑33511) in pyLoad Download Manager was disclosed via host header injection, but no exploits, patches, or active exploitation reports are referenced.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pyload | pyload | - | - | - |
| App | pyload-ng_project | pyload-ng | - | python | - |