Priority MEDIUM 43
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
Lookyloo
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Lookyloo records in CISA KEVNo Lookyloo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records
TI-2026-47455 CVE-2026-66824 · GHSA-vjmw-phg6-9f2x
Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
Priority MEDIUM 42
A stored cross-site scripting vulnerability existed in the capture tree visualization page.
TI-2026-79541 CVE-2026-55835
Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
Priority LOW 37
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
TI-2026-58562 CVE-2026-85242 · GHSA-47hh-m5vw-329p
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
Priority LOW 37
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality.
TI-2026-32379 CVE-2026-44439 · GHSA-687h-xw6f-q2qw
LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture
Priority LOW 35
PlaywrightCapture is a simple replacement for splash using playwright.
TI-2026-45082 CVE-2026-63175 · GHSA-45hp-h3fx-8mr2
Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture
Priority LOW 32
PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables.
Priority LOW 31
Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.
TI-2026-51347 CVE-2026-73210
Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture
Priority LOW 24
A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.
TI-2025-40891 CVE-2025-66459
Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
Priority LOW 24
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
TI-2025-40892 CVE-2025-66460
Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables
Priority LOW 23
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
Priority LOW 23
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.