CVE-2026-40071 pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execut...

CVE-2026-40071 pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execut...

CVE-2026-40071

CVE-2026-40071 affects the pyLoad download manager (Python). The weakness lies in the WebUI JSON endpoints /json/package_order, /json/link_order, and /json/abort_link, which enforce weaker permissions than the core API methods they invoke. This permits authenticated, low-privileged users to perfo...

CVE-2026-40071

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execut...

kernel: Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling

A flaw was found in the mlx5e Traffic Control TC encapsulation logic in the net/mlx5e driver of the Linux kernel. The code responsible for invalidating encapsulation actions did not use the proper helper function to retrieve the correct encapsulation attribute, instead assuming the default...

kernel: Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling

A flaw was found in the mlx5e Traffic Control TC encapsulation logic in the net/mlx5e driver of the Linux kernel. The code responsible for invalidating encapsulation actions did not use the proper helper function to retrieve the correct encapsulation attribute, instead assuming the default...