CVE-2026-77467 Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

EUVD-2026-102194

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

CVE-2026-77467

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

CVE-2026-77467 Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

CVE-2026-77467

The photo-management tool Lychee (prior to version 7.7.0 ) is vulnerable to a denial-of-service condition due to an uncontrolled resource consumption flaw in the ImagickHandler::loadPdf() function. When processing PDFs via ImageMagick and Ghostscript, the application fails to apply an effective p...

Mass-Scanner-CVE-2026-3891

Mass Scanner CVE-2026-3891 A clean and animated GitHub presentation for a Python-based Mass Scanner CVE-2026-3891 focused on validating a specific WordPress AJAX behavior in controlled environments. This repository is intended strictly for authorized security testing, internal audits, lab...

CVE-2026-0770

🚀 CVE-2026-0770 – Langflow RCE execglobal PoC Remote Code Execution vulnerability in Langflow 📌 Affected Software This vulnerability affects: Langflow 🧠 Vulnerability Overview CVE-2026-0770 is a Remote Code Execution RCE vulnerability in the: /api/v1/validate/code endpoint. When AUTOLOGIN=true an...

CVE-2026-61611 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-61611 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-22005-OAuth-2.0-Device-Code-Phishing-Short-Interval-

CVE-2026-22005 – OAuth 2.0 Device Code Phishing Short Interval Program Code Python devicecodeserver.py - Authorization server with too-fast polling import time, secrets codes = @app.route'/device/code' def devicecode: code = secrets.tokenurlsafe16 codescode = 'usercode': secrets.tokenhex4,...

CVE-2026-97666

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-111093

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files...

CVE-2026-100350

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An...

Cassio Santos Whaticket Open Source Authorization Issue Vulnerability

Cassio Santos: Whaticket Open Source versions from cf04795 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references IDOR. ShowTicketService does not perform ownership or queue checks. Attackers can use the ticket IDs of other agents to...

Nezhahq Nezha resource management error vulnerability

In versions from 1.0.0 to 2.3.15, there was a resource management error vulnerability in the dashboard file manager. This vulnerability stemmed from the fact that the fmStream in the WebSocket endpoint of the file manager did not call SetReadLimit. As a result, the message size became unlimited,...

Rocboss PaoPao Authorization Issue Vulnerability

Robcoboss PaoPao versions 0.6.0-alpha.3 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DownloadAttachment function. Attackers can enumerate consecutive postcontent IDs through the /v1/attachment endpoint, thereby...

PickMall Lilishop authorization issue vulnerability

PickMall Lilishop versions 5.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of ownership checks in the ReceiptServiceImpl.getDetail method. Unsafe direct object references exist, allowing attackers to provide the receipt IDs of other buyers and...

Exrick XBoot Authorization Issue Vulnerability

Exrick XBoot 3.3.4 and earlier versions have an authorization issue vulnerability. This vulnerability arises from the failure to validate the scope of role data. Attackers can exploit this vulnerability by making a GET request to xboot/user/getByDepartmentId/departmentId, with any department ID...

Wayn111 Waynboot-Mall Authorization Issue Vulnerability

Wayn111 and Waynboot-Mall versions 2.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication at the /callback/order/unpaid endpoint. Unverified attackers can cancel pending orders for any member by submitting a predictable orderSn value...

Devolutions Server Authorization Issue Vulnerability

Devolutions Server 2026.3.8.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control of asset contact passwords. Certified users who have regular editing permissions but do not have editing rights for assets can modify asset contact...