Login Request a demo
LY
Product
Lychee
by LycheeOrg · last CVE Oct 15, 2026
21
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Vulnerabilities21In the news0Timeline
Severity mix
Critical 1High 8Medium 9Low 3
Severity
All severities21Critical1High8Medium9Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Lychee to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-53018
3.0
0%
Jun 27
Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs
Affected: < 6.6.13
CVE-2026-61610
2.3
0%
Oct 15
Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous
Affected: < 7.6.1
CVE-2026-57569
2.3
0%
Oct 15
Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation
Affected: < 7.6.0
Showing 3