pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

High severity GitHub Reviewed Published Apr 24, 2026 in pyload/pyload • Updated Jun 8, 2026

No open alerts for this advisory

Give feedback on Dependabot alerts