PYSEC-2026-1815 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

The vulnerabilities of the functions cnl_ipc4_irq_thread() and cnl_ipc_irq_thread() in the sound/soc/sof/intel/cnl.c module, which are part of the Linux SoC audio support, allow a malicious actor to cause system failures.

The vulnerability of the functions cnlipc4irqthread and cnlipcirqthread in the sound/soc/sof/intel/cnl.c module, which is part of the Linux SoC audio support, relates to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

Cross-site Scripting

pyloadng is vulnerable to Cross-site Scripting. The vulnerability is due to unsafe handling of untrusted parameters in the Captcha and CNL endpoints, allowing attackers to inject malicious content or manipulate request processing, leading to Cross-site Scripting or other unintended behaviors...

EUVD-2022-55293

Malicious code in bioql PyPI...

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

Allocation of Resources Without Limits or Throttling

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the jk parameter in the CNL Blueprint process. An attacker can cause the server CPU to become fully...

CVE-2025-57751

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs, resulting in the server CPU being fully occupi...

CVE-2025-57751 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs, resulting in the server CPU being fully occupi...

CVE-2025-54802

CVE-2025-54802 concerns pyload-ng’s addcrypted endpoint, where a path-traversal via the package parameter enables arbitrary file writes outside the designated storage dir, potentially causing remote code execution as root. The vulnerability arises from unsafe path construction in the CNL Blueprin...

CVE-2025-54802 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution RCE. The addcrypted...

CVE-2025-54802

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution RCE. The addcrypted...

CVE-2025-54802: Improper Limitation of a Pathname to a Restricted Directory

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution RCE. The addcrypted...

CVE-2022-50016: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if FWREADY...

GSD-2022-1005078 ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot

ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

PT-2022-33336

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.19.4 Description The issue is related to the ASoC SOF Intel cnl component, where IPC replies are processed before firmware boot. The actual impact and attack plausibility have not yet been proven. Recommendatio...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:2957-1)

This update for ucode-intel fixes the following issues : Updated to 20191112 security release bsc1155988 - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old-New - ---- new platforms ---------------------------------------- - CML-U62 A0 6-a6-0/80 000000c6 Core Gen10 Mobile - CNL...