Leyka

Leyka has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 10 are fixed and 4 remain unpatched as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2023 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

10 of the records (71%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2025.

12 independent researchers contributed these findings, most of them (2) reported by Peter Thaleikis.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all Leyka vulnerabilities before they are exploited.

Most severe open issueCVSS 8.1CVE-2025-52805

Leyka <= 3.31.9 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

14 records


2026-10-07 00:00	Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection Leyka <= 3.32.3	`CVE-2026-42717`	4.9 Medium	Ananda Dhakal	No
2026-08-19 00:00	Leyka <= 3.32.3 - Missing Authorization Leyka <= 3.32.3	`CVE-2026-66677`	4.3 Medium	Jakub Herman	No
2025-07-01 00:00	Leyka <= 3.31.9 - Unauthenticated Local File Inclusion Leyka <= 3.31.9	`CVE-2025-52805`	8.1 High	Nguyen Xuan Chien	No
2025-06-27 00:00	Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Leyka <= 3.31.9	`CVE-2025-53275`	6.4 Medium	Peter Thaleikis	No
2025-02-14 00:00	Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Leyka <= 3.31.8	`CVE-2025-26766`	6.4 Medium	Peter Thaleikis	Yes
2024-10-14 00:00	Leyka <= 3.31.6 - Missing Authorization Leyka <= 3.31.6	`CVE-2024-49252`	4.3 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-06-06 00:00	Leyka <= 3.31.1 - Missing Authorization Leyka <= 3.31.1	`CVE-2024-35683`	5.3 Medium	Kévin Mosbahi (Mika)	Yes
2023-09-12 00:00	Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure Leyka <= 3.30.7	`CVE-2023-4917`	5.3 Medium	István Márton	Yes
2023-08-23 00:00	Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Leyka < 3.30.3	`CVE-2023-2995`	4.4 Medium	An Dang	Yes
2023-08-07 00:00	Leyka <= 3.30.2 - Reflected Cross-Site Scripting Leyka <= 3.30.2	`CVE-2023-39314`	6.1 Medium	Phd	Yes

Showing 1–10 of 14 reports