{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.0b3.dev101"}],"component":"pyload-ng","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-p3pr-8f3m-4qp8","id":"tcs_01M5KFS6A9NQ36TD8BPTMJHAGD","modified_at":"2026-10-26T16:01:33.004404173Z","published_at":"2026-10-09T17:09:03Z","references":["https://osv.dev/vulnerability/GHSA-p3pr-8f3m-4qp8","https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8","https://github.com/pyload/pyload","https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-p3pr-8f3m-4qp8","url":"https://osv.dev/vulnerability/GHSA-p3pr-8f3m-4qp8"}],"summary":"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host"}