{"metadata": {"vulnerability": "CVE-2026-77468", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-08-20T20:07:49.962Z", "date_only": false, "value": "2026-08-20T20:07:49.962Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77468", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T16:35:21.137Z", "date_only": false, "value": "2026-10-15T16:35:21.137Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77468", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T16:35:21.137Z", "date_only": false, "value": "2026-10-15T16:35:21.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77468", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:35:21.137Z", "date_only": false, "value": "2026-10-15T16:35:21.137Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-77468", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:51:30.628Z", "date_only": false, "value": "2026-10-15T16:51:30.628812Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117445957396376022", "record": "CVE-2026-77468", "field": "creation_timestamp", "uuid": "53ed2e75-e7db-493d-b313-d7299d7e0eed", "content": "CVE-2026-77468 Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77468https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-xg8r-4pm3-2h4fhttps://github.com/LycheeOrg/Lychee/pull/4510https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0#LycheeOrg #Lychee#CVE_2026_77468#bot", "url": "https://infosec.exchange/users/cve/statuses/117445957396376022"}, {"timestamp": "2026-10-15T17:17:27.860Z", "date_only": false, "value": "2026-10-15T17:17:27.860", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77468", "record": "FKIE_CVE-2026-77468", "field": "published"}, {"timestamp": "2026-10-15T21:08:49.703Z", "date_only": false, "value": "2026-10-15T21:08:49.703", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77468", "record": "FKIE_CVE-2026-77468", "field": "lastModified"}]}