Vulnerabilities

TI-2026-24782 CVE-2026-32253

Sunshine: Authentication bypass via improper client certificate validation

HIGH 82

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00291 Published 2026-05-22 Fixed in 2026.516.143833 CWE-287

TI-2025-33924 CVE-2025-54081

SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution

HIGH 66

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00234 Published 2025-09-23 Fixed in 2025.923.33222 CWE-428

TI-2025-09364 CVE-2025-10199 · GHSA-7fx4-846p-mpq2

A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows

LOW 35

A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00187 Published 2025-09-09 No fix listed CWE-428

TI-2025-09363 CVE-2025-10198 · GHSA-m9hx-h78h-jqvc

LizardBytes Sunshine for Windows contains a DLL search-order hijacking vulnerability

LOW 35

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00218 Published 2025-09-09 No fix listed CWE-427

TI-2025-33088 CVE-2025-53095

Sunshine application-wide CSRF in the UI leads to command injection as Administrator

MEDIUM 42

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00239 Published 2025-07-01 Fixed in 2025.628.4510 CWE-352

TI-2025-33089 CVE-2025-53096

Sunshine clickjacking in the UI leads to unauthorized actions being performed

LOW 27

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00242 Published 2025-07-01 Fixed in 2025.628.4510 CWE-1021

TI-2024-34644 CVE-2024-51738

Sunshine improperly enforces pairing protocol request order

LOW 37

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.006 Published 2025-01-20 Fixed in 2025.118.151840 CWE-305

TI-2024-30456 CVE-2024-45407

Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

LOW 29

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2024-09-10 No fix listed CWE-300

TI-2024-20602 CVE-2024-31226

Sunshine's unquoted executable path could lead to hijacked execution flow

LOW 24

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1MEDIUM 4.9 Physical High privileges User interaction EPSS 0.00217 Published 2024-05-16 Fixed in 0.23.0 CWE-428

TI-2024-20598 CVE-2024-31221

Clients removed during unpairing process may regain access if Sunshine was not restarted

LOW 27

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00509 Published 2024-04-08 Fixed in 0.23.0 CWE-384

TI-2024-20597 CVE-2024-31220

Sunshine vulnerable to remote unauthenticated arbitrary file read

LOW 33

Sunshine is a self-hosted game stream host for Moonlight.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00491 Published 2024-04-05 Fixed in 0.18.0 CWE-22

Vulnerabilities

Filters