Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the ssl_certchain option was never added to the admin-only set at all. This vulnerability is fixed in 0.5.0b3.dev97.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-07 | 2 | Disclosure1General1 |
| 2026-05-05 | 1 | General1 |
🔴 pyload, Insecure Allowlist Bypass, #CVE-2026-35586 (Critical) https://dailycve.com/pyload-insecure-allowlist-bypass-cve-2026-35586-critical/
Post summary
The provided text announces a critical insecure allowlist bypass CVE for pyload but does not supply any technical, exploit, or patch information.
🚨*CVE* CVE-2026-35586 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses … https://www.cve.org/CVERecord?id=CVE-2026-35586 ----- Traducción: CVE-2026-35586 pyL… http://infoflow.cloud`
Post summary
The post announces CVE-2026-35586 in pyLoad, noting a pre-0.5.0b3.dev97 issue with ADMIN_ONLY_CORE_OPTIONS, but provides no PoC, exploit, or patch details.
CVE-2026-35586 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses … https://www.cve.org/CVERecord?id=CVE-2026-35586
Post summary
The text merely lists the CVE reference without providing actionable details, evidence of exploitation, or remediation steps.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pyload-ng_project | pyload-ng | - | python | - |