{"action":"No fix published. Pin and monitor.","affected":[],"component":"pyload-ng","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9q47-3cm2-2rp8","id":"tcs_01M5KFBC5380F3Y8V87B1KYBXE","modified_at":"2026-10-09T17:15:04.817149437Z","published_at":"2026-10-09T17:09:12Z","references":["https://osv.dev/vulnerability/GHSA-9q47-3cm2-2rp8","https://github.com/pyload/pyload/security/advisories/GHSA-9q47-3cm2-2rp8","https://github.com/pyload/pyload/commit/5dc6b628e2d8b9f42dde82f396e5b7a2b513f6d1","https://github.com/pyload/pyload"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-9q47-3cm2-2rp8","url":"https://osv.dev/vulnerability/GHSA-9q47-3cm2-2rp8"}],"summary":"pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header"}