CVE-2026-123814

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123814

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

EUVD-2026-120450

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123814

The pyLoad download manager (versions prior to 0.5.0b3.dev102 ) is vulnerable to Server-Side Request Forgery (SSRF) . An authenticated non-admin user with SETTINGS permissions can use the /json/save_config endpoint to configure the WindowsPhoneNotify addon. Because the addon's WindowsPhoneNotify....