{"items":[{"id":"CVE-2026-111044","published":"2026-10-16T21:59:00.939Z","updated":"2026-10-28T15:32:53.402Z","title":"Disabled Sunshine clients can bypass revocation with a derived client certificate","severity":"HIGH","score":7.6,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-32253","published":"2026-05-22T17:07:04.619Z","updated":"2026-05-26T13:08:19.472Z","title":"Sunshine: Authentication bypass via improper client certificate validation","severity":"CRITICAL","score":9.8,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2025-54081","published":"2025-09-23T18:18:39.474Z","updated":"2025-09-23T19:17:53.733Z","title":"SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution","severity":"MEDIUM","score":6.7,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2025-10199","published":"2025-09-09T17:30:19.958Z","updated":"2025-11-03T18:08:25.842Z","title":"A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows","severity":"HIGH","score":7.8,"vendor":"LizardByte","product":"Sunshine for Windows","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2025-10198","published":"2025-09-09T17:28:14.696Z","updated":"2026-01-20T16:12:44.974Z","title":"LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability","severity":"HIGH","score":7.8,"vendor":"LizardByte","product":"Sunshine for Windows","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2025-53095","published":"2025-07-01T01:33:22.331Z","updated":"2025-07-01T13:21:15.143Z","title":"Sunshine application-wide CSRF in the UI leads to command injection as Administrator","severity":"CRITICAL","score":9.7,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2025-53096","published":"2025-07-01T01:33:01.336Z","updated":"2025-07-01T13:21:41.271Z","title":"Sunshine clickjacking in the UI leads to unauthorized actions being performed","severity":"MEDIUM","score":5.4,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2024-51738","published":"2025-01-20T15:26:03.955Z","updated":"2025-01-21T14:59:35.704Z","title":"Sunshine improperly enforces pairing protocol request order","severity":"HIGH","score":7.7,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2024-45407","published":"2024-09-10T15:13:20.126Z","updated":"2024-09-10T16:12:18.563Z","title":"Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client","severity":"MEDIUM","score":6.5,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2024-31226","published":"2024-05-16T18:12:57.081Z","updated":"2024-08-15T14:28:39.036Z","title":"Sunshine's unquoted executable path could lead to hijacked execution flow","severity":"MEDIUM","score":4.9,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2024-31221","published":"2024-04-08T15:10:17.071Z","updated":"2024-09-03T18:00:09.752Z","title":"Clients removed during unpairing process may regain access if Sunshine was not restarted","severity":"MEDIUM","score":5.9,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2024-31220","published":"2024-04-05T14:59:52.662Z","updated":"2024-08-02T01:46:04.755Z","title":"Sunshine vulnerable to remote unauthenticated arbitrary file read","severity":"HIGH","score":7.3,"vendor":"LizardByte","product":"Sunshine","kev":false,"epss":0.00491,"kevAdded":null}]}