Lookyloo has 4 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The busiest recent month was December 2025 with 3. The median CVSS is 6.1 (medium). The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2026-55835Medium· 6.9Lookyloo: Potential sub-system DoS due to parameter missmatch in notification38CVE-2025-66460Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other34CVE-2025-66459Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other34CVE-2025-66458Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other34
Lookyloo vulnerabilities
CVEs affecting Lookyloo, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-55835Medium· 6.9Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (…
CVE-2025-66460Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogo…
CVE-2025-66459Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of …
CVE-2025-66458Medium· 6.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malic…