LY
Vendor
LycheeOrg
21
CVEs
0
On KEV
10
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-77466 | LY Lychee LycheeOrg | 8.3 | Oct 15 | Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection |
| CVE-2026-77470 | LY Lychee LycheeOrg | 8.3 | Oct 15 | Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request |
| CVE-2026-77468 | LY Lychee LycheeOrg | 6.9 | Oct 15 | Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api |
| CVE-2026-77467 | LY Lychee LycheeOrg | 7.1 | Oct 15 | Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path |
| CVE-2026-62679 | LY Lychee LycheeOrg | 8.9 | Oct 15 | Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read |
| CVE-2026-61838 | LY Lychee LycheeOrg | 8.2 | Oct 15 | Lychee: Album password bypass in ZIP downloads |
| CVE-2026-61610 | LY Lychee LycheeOrg | 2.3 | Oct 15 | Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous |
| CVE-2026-61611 | LY Lychee LycheeOrg | 7.5 | Oct 15 | Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks |
| CVE-2026-57569 | LY Lychee LycheeOrg | 2.3 | Oct 15 | Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation |
| CVE-2026-57568 | LY Lychee LycheeOrg | 5.7 | Oct 15 | Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) |
| CVE-2026-39957 | LY Lychee LycheeOrg | 4.3 | Apr 9 | Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users |
| CVE-2026-33738 | LY Lychee LycheeOrg | 5.4 | Mar 26 | Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) |
| CVE-2026-33644 | LY Lychee LycheeOrg | 4.3 | Mar 26 | Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs |
| CVE-2026-33537 | LY Lychee LycheeOrg | 5.0 | Mar 26 | Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked |
| CVE-2026-22784 | LY Lychee LycheeOrg | 4.3 | Jan 12 | Lychee cross-album password propagation on Album unlocking |
| CVE-2025-53018 | LY Lychee LycheeOrg | 3.0 | Jun 27 | Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs |
| CVE-2025-50202 | LY Lychee LycheeOrg | 7.5 | Jun 18 | Lychee Path Traversal Vulnerability |
| CVE-2024-25808 | LY Lychee Lycheeorg | 8.3 | Mar 22 | Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function |
| CVE-2024-25807 | LY Lychee Lycheeorg | 6.1 | Mar 22 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating… |
| CVE-2023-52082 | LY Lychee Lycheeorg | 9.8 | Dec 28 | Lychee is a free photo-management tool |
| CVE-2021-43675 | LY Lychee Lycheeorg | 6.1 | Dec 15 | Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php |