agentprime: lycheeEvery new CVE for lychee.https://agentprime.io/CVE-2026-77466: Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selectionhttps://agentprime.io/advisories/CVE-2026-77466/https://agentprime.io/advisories/CVE-2026-77466/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:36:58 GMTCVECVE-2026-77470: Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST requesthttps://agentprime.io/advisories/CVE-2026-77470/https://agentprime.io/advisories/CVE-2026-77470/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:36:09 GMTCVECVE-2026-77468: Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/apihttps://agentprime.io/advisories/CVE-2026-77468/https://agentprime.io/advisories/CVE-2026-77468/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:35:21 GMTCVECVE-2026-77467: Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing pathhttps://agentprime.io/advisories/CVE-2026-77467/https://agentprime.io/advisories/CVE-2026-77467/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:34:35 GMTCVECVE-2026-62679: Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file readhttps://agentprime.io/advisories/CVE-2026-62679/https://agentprime.io/advisories/CVE-2026-62679/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:33:43 GMTCVECVE-2026-61838: Lychee: Album password bypass in ZIP downloadshttps://agentprime.io/advisories/CVE-2026-61838/https://agentprime.io/advisories/CVE-2026-61838/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:32:37 GMTCVECVE-2026-61610: Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymoushttps://agentprime.io/advisories/CVE-2026-61610/https://agentprime.io/advisories/CVE-2026-61610/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:26:16 GMTCVECVE-2026-61611: Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attackshttps://agentprime.io/advisories/CVE-2026-61611/https://agentprime.io/advisories/CVE-2026-61611/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:25:24 GMTCVECVE-2026-57569: Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validationhttps://agentprime.io/advisories/CVE-2026-57569/https://agentprime.io/advisories/CVE-2026-57569/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:24:34 GMTCVECVE-2026-57568: Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)https://agentprime.io/advisories/CVE-2026-57568/https://agentprime.io/advisories/CVE-2026-57568/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 16:22:30 GMTCVECVE-2026-39957: Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized usershttps://agentprime.io/advisories/CVE-2026-39957/https://agentprime.io/advisories/CVE-2026-39957/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Apr 2026 16:14:56 GMTCVECVE-2026-33738: Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)https://agentprime.io/advisories/CVE-2026-33738/https://agentprime.io/advisories/CVE-2026-33738/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Mar 2026 20:25:44 GMTCVECVE-2026-33644: Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPshttps://agentprime.io/advisories/CVE-2026-33644/https://agentprime.io/advisories/CVE-2026-33644/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Mar 2026 20:04:18 GMTCVECVE-2026-33537: Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blockedhttps://agentprime.io/advisories/CVE-2026-33537/https://agentprime.io/advisories/CVE-2026-33537/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Mar 2026 20:01:19 GMTCVECVE-2026-22784: Lychee cross-album password propagation on Album unlockinghttps://agentprime.io/advisories/CVE-2026-22784/https://agentprime.io/advisories/CVE-2026-22784/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Jan 2026 18:37:55 GMTCVECVE-2025-53018: Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLshttps://agentprime.io/advisories/CVE-2025-53018/https://agentprime.io/advisories/CVE-2025-53018/CVSS 3.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Jun 2025 13:00:14 GMTCVECVE-2025-50202: Lychee Path Traversal Vulnerabilityhttps://agentprime.io/advisories/CVE-2025-50202/https://agentprime.io/advisories/CVE-2025-50202/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Jun 2025 04:13:01 GMTCVECVE-2023-52082: Lychee is vulnerable to an SQL Injection in explain DB queries.https://agentprime.io/advisories/CVE-2023-52082/https://agentprime.io/advisories/CVE-2023-52082/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 28 Dec 2023 15:46:24 GMTCVE