litespeedtech

Records47All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

litespeedtech records in CISA KEV

TI-2026-39296 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability CRITICAL 96KEV 2026-06-15 TI-2026-35606 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability CRITICAL 100KEV 2026-05-26

Components

Products in the NVD configurations · select one to filter the records

Litespeed Cache 15 records CRITICAL Openlitespeed 12 records HIGH Litespeed Web Server 5 records MEDIUM Lsquic 3 records MEDIUM Litespeed Cpanel Plugin 2 records CRITICAL Litespeed Whm Plugin 2 records CRITICAL Litespeed Web Adc 1 record LOW

Records

5 records in Litespeed Web Server · all components

TI-2010-02240 CVE-2010-2333 · GHSA-76v5-m293-786v

LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers…

MEDIUM 57

LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.60196 Published 2010-06-18 No fix listed CWE-200

TI-2026-23945 CVE-2026-31386 · GHSA-3gr9-8p27-7f3p

OS command injection in LiteSpeed Technologies OpenLiteSpeed

MEDIUM 42

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01471 Published 2026-03-16 No fix listed CWE-78

TI-2004-00095 CVE-2004-0112 · GHSA-ph6p-3j2f-xq2g

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos…

LOW 35

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a de…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.10424 Published 2004-03-18 Fixed CWE-125

TI-2025-34659 CVE-2025-54939 · GHSA-839r-7hhg-xhqr

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

LOW 34

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00837 Published 2025-08-01 Fixed in 4.3.1 CWE-770

TI-2012-04115 CVE-2012-4871 · GHSA-h97f-hm3r-hh8r

Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator…

LOW 23

Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the gtitle parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01633 Published 2012-09-06 No fix listed CWE-79

Open these records in search →

Critical	8
High	18
Medium	21
Low	0
No CVSS	0