{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.0b3.dev97"}],"component":"pyload-ng","cve_ids":["CVE-2026-41133"],"ecosystem":"PyPI","epss":0.00325,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-66hx-chf7-3332","id":"tcs_01M5KH2S3EC4YBAPJRKHE218CK","modified_at":"2026-07-13T16:32:35.333738024Z","published_at":"2026-07-13T15:02:47.816792Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2990","https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332","https://nvd.nist.gov/vuln/detail/CVE-2026-41133","https://github.com/pyload/pyload/commit/e95804fb0d06cbb07d2ba380fc494d9ff89b68c1","https://github.com/pyload/pyload","https://pypi.org/project/pyload-ng","https://github.com/advisories/GHSA-66hx-chf7-3332"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2990","url":"https://osv.dev/vulnerability/PYSEC-2026-2990"}],"summary":"pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)"}