litespeedtech

Records47All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

litespeedtech records in CISA KEV

TI-2026-39296 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability CRITICAL 96KEV 2026-06-15 TI-2026-35606 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability CRITICAL 100KEV 2026-05-26

Components

Products in the NVD configurations · select one to filter the records

Litespeed Cache 15 records CRITICAL Openlitespeed 12 records HIGH Litespeed Web Server 5 records MEDIUM Lsquic 3 records MEDIUM Litespeed Cpanel Plugin 2 records CRITICAL Litespeed Whm Plugin 2 records CRITICAL Litespeed Web Adc 1 record LOW

Records

12 records in Openlitespeed · all components

TI-2022-00030 CVE-2022-0073 · GHSA-p42f-x6hp-xv84

Authenticated Remote Code Execution in OpenLiteSpeed Web Server

HIGH 73

Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09736 Published 2022-10-27 Fixed in 1.7.16.1 CWE-20

TI-2020-04489 CVE-2020-5519 · GHSA-88rm-g49p-m632

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs…

MEDIUM 44

The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01197 Published 2020-01-06 No fix listed CWE-20

TI-2021-08426 CVE-2021-26758 · GHSA-9f37-v7ww-2cmh

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8…

MEDIUM 43

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02707 Published 2021-04-07 No fix listed CWE-269

TI-2026-23945 CVE-2026-31386 · GHSA-3gr9-8p27-7f3p

OS command injection in LiteSpeed Technologies OpenLiteSpeed

MEDIUM 42

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01471 Published 2026-03-16 No fix listed CWE-78

TI-2022-00031 CVE-2022-0074 · GHSA-p85c-c374-mg9g

Privilege Escalation in OpenLiteSpeed Web Server

MEDIUM 41

Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01433 Published 2022-10-27 Fixed in 1.7.16.1 CWE-426

TI-2023-21334 CVE-2023-40518 · GHSA-qg79-g97j-8qg5

LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.

MEDIUM 40

LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00652 Published 2023-08-14 No fix listed

TI-2015-03304 CVE-2015-3890 · GHSA-7qpw-4747-ch6g

Use-after-free vulnerability in Open Litespeed before 1.3.10.

LOW 35

Use-after-free vulnerability in Open Litespeed before 1.3.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01059 Published 2017-09-20 No fix listed CWE-416

TI-2025-34659 CVE-2025-54939 · GHSA-839r-7hhg-xhqr

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

LOW 34

LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00837 Published 2025-08-01 Fixed in 4.3.1 CWE-770

TI-2018-14014 CVE-2018-19791 · GHSA-p7xx-c3fx-mhqh

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests…

LOW 31

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demons…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01239 Published 2018-12-03 No fix listed CWE-20

TI-2024-20896 CVE-2024-31617 · GHSA-5wp7-92wc-c55h

OpenLiteSpeed before 1.8.1 mishandles chunked encoding.

LOW 30

OpenLiteSpeed before 1.8.1 mishandles chunked encoding.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00438 Published 2024-05-22 No fix listed CWE-770

TI-2018-14015 CVE-2018-19792 · GHSA-8jp3-8rhj-499h

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a…

LOW 30

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed pro…

CVSS 3.0MEDIUM 6.7 Local High privileges No interaction EPSS 0.00428 Published 2018-12-03 No fix listed CWE-119

TI-2022-00029 CVE-2022-0072 · GHSA-f532-g5cf-vhjp

Directory Traversal in OpenLiteSpeed Web Server

LOW 28

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01143 Published 2022-10-27 Fixed in 1.7.16.1 CWE-22

Open these records in search →