Lizardbyte - vulnerabilities (CVEs)
12 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-16.
Products
- Sunshine - 11 CVEs
- Sunshine For Windows - 2 CVEs
Newest CVEs of Lizardbyte
- CVE-2026-111044 - CVSS 7.6 (high), 2026-10-16: Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to…
- CVE-2026-32253 - CVSS 9.8 (critical), 2026-05-22: Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because…
- CVE-2025-54081 - CVSS 7 (high), 2025-09-23: Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted…
- CVE-2025-10199 - CVSS 7.8 (high), 2025-09-09: A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.
- CVE-2025-10198 - CVSS 7.8 (high), 2025-09-09: Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in…
- CVE-2025-53096 - CVSS 6.1 (medium), 2025-07-01: Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking…
- CVE-2025-53095 - CVSS 9.7 (critical), 2025-07-01: Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request…
- CVE-2024-51738 - CVSS 8.1 (high), 2025-01-20: Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order…
- CVE-2024-45407 - CVSS 6.5 (medium), 2024-09-10: Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to…
- CVE-2024-31226 - CVSS 4.9 (medium), 2024-05-16: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when…
- CVE-2024-31221 - CVSS 5.9 (medium), 2024-04-08: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI…
- CVE-2024-31220 - CVSS 7.3 (high), 2024-04-05: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read…
