Login Request a demo
LY
Product
Lychee
by LycheeOrg · last CVE Oct 15, 2026
21
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Vulnerabilities21In the news0Timeline
Severity mix
Critical 1High 8Medium 9Low 3
Severity
All severities21Critical1High8Medium9Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Lychee to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77468
6.9
0%
Oct 15
Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api
Affected: < 7.7.0
CVE-2024-25807
6.1
0%
Mar 22
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating…
Affected: 3.1.6
CVE-2021-43675
6.1
1%
Dec 15
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php
Affected: 3.2.16
CVE-2026-57568
5.7
0%
Oct 15
Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
Affected: < 7.6.0
CVE-2026-33738
5.4
0%
Mar 26
Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
Affected: < 7.5.3
CVE-2026-33537
5.0
0%
Mar 26
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
Affected: < 7.5.1
CVE-2026-39957
4.3
0%
Apr 9
Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users
Affected: < 7.5.4
CVE-2026-33644
4.3
0%
Mar 26
Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs
Affected: < 7.5.2
CVE-2026-22784
4.3
0%
Jan 12
Lychee cross-album password propagation on Album unlocking
Affected: < 7.1.0
Showing 9