Login Request a demo
LY
Product
Lychee
by LycheeOrg · last CVE Oct 15, 2026
21
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Vulnerabilities21In the news0Timeline
Severity mix
Critical 1High 8Medium 9Low 3
Severity
All severities21Critical1High8Medium9Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Lychee to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-62679
8.9
0%
Oct 15
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Affected: < 7.6.4
CVE-2026-77466
8.3
0%
Oct 15
Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
Affected: < 7.7.0
CVE-2026-77470
8.3
0%
Oct 15
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
Affected: < 7.7.1
CVE-2024-25808
8.3
0%
Mar 22
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function
Affected: 3.1.6
CVE-2026-61838
8.2
0%
Oct 15
Lychee: Album password bypass in ZIP downloads
Affected: < 7.6.3
CVE-2026-61611
7.5
0%
Oct 15
Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks
Affected: < 7.6.1
CVE-2025-50202
7.5
1%
Jun 18
Lychee Path Traversal Vulnerability
Affected: >= 6.6.6, < 6.6.10
CVE-2026-77467
7.1
0%
Oct 15
Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path
Affected: < 7.7.0
Showing 8