[ Vendor · 10 CVEs ]
LycheeOrg
CVEs affecting LycheeOrg published in the last 30 days, plus any LycheeOrg CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-77466 | 15 Oct 2026 | CVSS 8.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in… | |
| CVE-2026-77467 | 15 Oct 2026 | CVSS 7.1 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an… | |
| CVE-2026-77468 | 15 Oct 2026 | CVSS 6.9 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by… | |
| CVE-2026-77470 | 15 Oct 2026 | CVSS 8.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an… | |
| CVE-2026-61610 | 15 Oct 2026 | CVSS 2.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight… | |
| CVE-2026-61611 | 15 Oct 2026 | CVSS 7.5 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA… | |
| CVE-2026-61838 | 15 Oct 2026 | CVSS 8.2 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through… | |
| CVE-2026-62679 | 15 Oct 2026 | CVSS 8.9 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the… | |
| CVE-2026-57569 | 15 Oct 2026 | CVSS 2.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved… | |
| CVE-2026-57568 | 15 Oct 2026 | CVSS 5.7 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a… |