Login Request a demo
OP
Product
openlitespeed
by litespeedtech · last CVE Oct 2, 2026
13
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 1High 7Medium 5Low 0
Severity
All severities13Critical1High7Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openlitespeed to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-5519
9.8
1%
Jan 6
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen
Affected: before 1.6.5
CVE-2022-0074
8.8
1%
Oct 27
Privilege Escalation in OpenLiteSpeed Web Server
Affected: 1.6.15 before 1.7.16.1
CVE-2022-0073
8.8
10%
Oct 27
Authenticated Remote Code Execution in OpenLiteSpeed Web Server
Affected: 1.7.0 through 1.7.16.1
CVE-2021-26758
8.8
3%
Apr 7
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system
Affected: 1.7.8
CVE-2025-54939
7.5
1%
Aug 1
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak
Affected: before 1.8.4
CVE-2023-40518
7.5
1%
Aug 14
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers
Affected: before 1.7.18
CVE-2015-3890
7.5
1%
Sep 20
Use-after-free vulnerability in Open Litespeed before 1.3.10
Affected: before 1.3.10
CVE-2026-31386
7.2
1%
Mar 16
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability
Affected: through 1.9.0
CVE-2026-104474
6.7
0%
Oct 2
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update
Affected: before 1.9.3
CVE-2018-19792
6.7
0%
Dec 3
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a…
Affected: through 1.4.41; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0
CVE-2018-19791
6.5
1%
Dec 3
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the…
Affected: before 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.0; +1 more
CVE-2022-0072
5.8
1%
Oct 27
Directory Traversal in OpenLiteSpeed Web Server
Affected: 1.6.5 through 1.6.20.1; 1.7.0 before 1.7.16.1; 1.5.11; 1.5.12
CVE-2024-31617
5.3
0%
May 22
OpenLiteSpeed before 1.8.1 mishandles chunked encoding
Affected: before 1.8.1
Showing 13