Loading story…
Two high-severity vulnerabilities were disclosed in the open-source download manager pyLoad, both affecting versions prior to 0.5.0b3.dev97. CVE-2026-33511 allows an unauthenticated remote attacker to bypass ClickNLoad's localhost-only protection by spoofing the HTTP Host header, exposing restricted endpoints. The bypass can be used to inject arbitrary downloads, write files into pyLoad's storage directory, and execute JavaScript code.
A second flaw, CVE-2026-32808, enables arbitrary file deletion through path traversal during password verification of certain encrypted 7z archives with non-encrypted headers. pyLoad derives an archive entry name from 7z listing output and uses it as a filesystem path without confining it to the extraction directory, allowing deletion outside the intended path. Both issues were fixed in pyLoad 0.5.0b3.dev97, with the file-deletion bug tracked as CWE-22 and the ClickNLoad issue exposing a network-reachable authentication bypass.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A second vulnerability, CVE-2026-33511, was disclosed affecting pyLoad versions 0.4.20 through versions before 0.5.0b3.dev97. The issue allows authentication bypass through Host header injection in ClickNLoad, exposing localhost-restricted endpoints and enabling arbitrary download injection, file writes, and JavaScript execution.
A vulnerability tracked as CVE-2026-32808 was disclosed for pyLoad versions before 0.5.0b3.dev97. The flaw stems from unsafe handling of archive entry names from 7z listing output, enabling arbitrary file deletion via path traversal.
pyLoad released version 0.5.0b3.dev97, which fixed a path traversal issue in encrypted 7z password verification that could allow arbitrary file deletion outside the intended extraction directory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026