Product by LizardByte
LizardByte Sunshine
12 known vulnerabilities in LizardByte Sunshine (LizardByte), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-32253 | Sunshine: Authentication bypass via improper client certificate validation | 9.8 | |
| High | CVE-2026-111044 | Disabled Sunshine clients can bypass revocation with a derived client certificate | 7.6 | |
| High | CVE-2024-51738 | Sunshine improperly enforces pairing protocol request order | 8.1 | |
| Critical | CVE-2025-53095 | Sunshine application-wide CSRF in the UI leads to command injection as Administrator | 9.7 | |
| High | CVE-2024-31220 | Sunshine vulnerable to remote unauthenticated arbitrary file read | 7.3 | |
| High | CVE-2025-10198 | LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability | 7.8 | |
| High | CVE-2025-10199 | A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows | 7.8 | |
| Medium | CVE-2024-31221 | Clients removed during unpairing process may regain access if Sunshine was not restarted | 5.9 | |
| High | CVE-2025-54081 | SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution | 6.7 | |
| Medium | CVE-2024-45407 | LizardByte Sunshine: Channel Accessible by Non-Endpoint | 6.5 | |
| Medium | CVE-2025-53096 | Sunshine clickjacking in the UI leads to unauthorized actions being performed | 5.4 | |
| Medium | CVE-2024-31226 | Sunshine's unquoted executable path could lead to hijacked execution flow | 4.9 |