CVE-2026-55835

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.

• CWE-233

• https://github.com/Lookyloo/lookyloo/commit/d5b9a401998cd50b88e5d7425f82baac78d8f082
• https://github.com/Lookyloo/lookyloo/pull/1330
• https://github.com/Lookyloo/lookyloo/releases/tag/v1.39.4
• https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-66gj-hmcp-5cfj

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5583A security vulnerability has been detected in PHPGurukul Onl…6.3
• CVE-2026-55830RestrictedPython is a tool that helps to define a subset of …8.3
• CVE-2026-55831Netty is a network application framework for development of …7.5
• CVE-2026-55832Tract is a tiny, no-nonsense, self-contained TensorFlow and …6.1
• CVE-2026-55833Netty is a network application framework for development of …7.5
• CVE-2026-55834Pocket ID is an OIDC provider that allows users to authentic…4.3
• CVE-2026-55836Open Zaak is an open-source data and services layer for Dutc…6.8
• CVE-2026-55837dbt-mcp is a Model Context Protocol server for interacting w…6.8
• CVE-2026-55838RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-55839Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5584A vulnerability has been found in Fosowl agenticSeek 0.1.0. …9.8
• CVE-2026-55840Scoold is a Q&A and a knowledge sharing platform for teams. …5.4