Vulnerability DatabaseCVE-2026-33314

CVE-2026-33314:
Python vulnerability analysis and mitigation

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click'N'Load API endpoints, enabling attackers to remotely queue arbitrary downloads, leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS). This issue has been patched in version 0.5.0b3.dev97.

Source: NVD

Related Python vulnerabilities:

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
GHSA-66hx-chf7-3332	HIGH	8.8	Python	pyload-ng	No	No	Apr 14, 2026
CVE-2026-40192	HIGH	8.7	Python	pillow	No	Yes	Apr 15, 2026
CVE-2026-40347	MEDIUM	5.3	Python	python-multipart	No	Yes	Apr 15, 2026
GHSA-jj6c-8h6c-hppx	MEDIUM	4.8	Python	pypdf	No	Yes	Apr 15, 2026
GHSA-fj52-5g4h-gmq8	LOW	2.9	Python	pyload-ng	No	No	Apr 14, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

A threat intelligence database

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

David EstlickCISO

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

Adam FletcherChief Security Officer

"We know that if Wiz identifies something as critical, it actually is."

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo

CVE-2026-33314: Python vulnerability analysis and mitigation