LI
Vendor
litespeedtech
47
CVEs
4
On KEV
3
New 30D
Products
OP9.8
openlitespeed
litespeedtech
13 CVEs0 on KEV1 new
LW9.4
LiteSpeed Web Server
litespeedtech
6 CVEs0 on KEV1 new
LS9.8
lsquic
litespeedtech
4 CVEs0 on KEV1 new
LC9.8
Litespeed Cpanel Plugin
Litespeedtech
2 CVEs2 on KEV0 new
LW9.8
Litespeed Whm Plugin
Litespeedtech
2 CVEs2 on KEV0 new
LC9.8
LiteSpeed Cache
litespeedtech
19 CVEs0 on KEV0 new
LW7.5
Litespeed Web Adc
Litespeedtech
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115482 New | LS lsquic litespeedtech | 7.5 | Oct 22 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK… |
| CVE-2026-104474 | OP openlitespeed litespeedtech | 6.7 | Oct 2 | OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update |
| CVE-2026-93903 | LW LiteSpeed Web Server litespeedtech | 9.4 | Sep 30 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." |
| CVE-2026-76579 | LC LiteSpeed Cache litespeedtech | 4.7 | Sep 19 | LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter |
| CVE-2026-3129 | LC LiteSpeed Cache litespeedtech | 6.4 | Aug 28 | LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes |
| CVE-2026-18978 | LC LiteSpeed Cache litespeedtech | 7.2 | Aug 28 | LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
| CVE-2026-54420 In wildKEV | LC Litespeed Cpanel Plugin Litespeedtech | 8.5 | Jun 14 | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability |
| CVE-2026-3375 | LC LiteSpeed Cache litespeedtech | 7.2 | May 27 | LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints |
| CVE-2026-48172 In wildKEV | LC Litespeed Cpanel Plugin Litespeedtech | 9.8 | May 21 | LiteSpeed cPanel Plugin Privilege Escalation Vulnerability |
| CVE-2026-31386 | OP Openlitespeed Litespeedtech | 7.2 | Mar 16 | OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability |
| CVE-2025-54939 | OP Openlitespeed Litespeedtech | 7.5 | Aug 1 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak |
| CVE-2024-50550 | LC Litespeed Cache Litespeedtech | 9.8 | Oct 29 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a… |
| CVE-2024-44000 | LC Litespeed Cache Litespeedtech | 9.8 | Oct 20 | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from… |
| CVE-2024-47637 | LC Litespeed Cache Litespeedtech | 8.8 | Oct 16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1 |
| CVE-2024-47374 | LC Litespeed Cache Litespeedtech | 6.1 | Oct 5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This… |
| CVE-2024-47373 | LC Litespeed Cache Litespeedtech | 5.4 | Oct 5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This… |
| CVE-2024-9169 | LC Litespeed Cache Litespeedtech | 4.8 | Sep 25 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due to insufficient… |
| CVE-2024-28000 | LC Litespeed Cache Litespeedtech | 9.8 | Aug 21 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1 |
| CVE-2024-3246 | LC Litespeed Cache Litespeedtech | 5.4 | Jul 24 | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1 |
| CVE-2024-31617 | OP Openlitespeed Litespeedtech | 5.3 | May 22 | OpenLiteSpeed before 1.8.1 mishandles chunked encoding |
| CVE-2023-45000 | LC Litespeed Cache Litespeedtech | 5.3 | Apr 16 | Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.This issue affects LiteSpeed Cache: from n/a through 5.7 |
| CVE-2023-40000 | LC Litespeed Cache Litespeedtech | 6.1 | Apr 16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects… |
| CVE-2024-25678 | LS Lsquic Litespeedtech | 9.8 | Feb 9 | In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled |
| CVE-2023-4372 | LC Litespeed Cache Litespeedtech | 5.4 | Jan 11 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input… |
| CVE-2023-40518 | OP Openlitespeed Litespeedtech | 7.5 | Aug 14 | LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers |
| CVE-2022-46800 | LC Litespeed Cache Litespeedtech | 8.8 | May 25 | Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions |
| CVE-2022-0074 | OP Openlitespeed Litespeedtech | 8.8 | Oct 27 | Privilege Escalation in OpenLiteSpeed Web Server |
| CVE-2022-0073 | OP Openlitespeed Litespeedtech | 8.8 | Oct 27 | Authenticated Remote Code Execution in OpenLiteSpeed Web Server |
| CVE-2022-0072 | OP Openlitespeed Litespeedtech | 5.8 | Oct 27 | Directory Traversal in OpenLiteSpeed Web Server |
| CVE-2022-30592 | LS Lsquic Litespeedtech | 9.8 | May 11 | liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY |
| CVE-2021-24964 | LC Litespeed Cache Litespeedtech | 6.1 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain… |
| CVE-2021-24963 | LC Litespeed Cache Litespeedtech | 4.8 | Jan 3 | The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site… |
| CVE-2021-26758 | OP Openlitespeed Litespeedtech | 8.8 | Apr 7 | Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system |
| CVE-2020-29172 | LC Litespeed Cache Litespeedtech | 6.1 | Dec 26 | A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting |
| CVE-2020-5519 | OP Openlitespeed Litespeedtech | 9.8 | Jan 6 | The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen |
| CVE-2018-19792 | OP Openlitespeed Litespeedtech | 6.7 | Dec 3 | The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a… |
| CVE-2018-19791 | OP Openlitespeed Litespeedtech | 6.5 | Dec 3 | The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the… |
| CVE-2015-3890 | OP Openlitespeed Litespeedtech | 7.5 | Sep 20 | Use-after-free vulnerability in Open Litespeed before 1.3.10 |
| CVE-2012-4871 | LW Litespeed Web Server Litespeedtech | – | Sep 6 | Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script… |
| CVE-2010-2333 | LW Litespeed Web Server Litespeedtech | – | Jun 18 | LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt… |
| CVE-2004-0112 | LW Litespeed Web Server Litespeedtech | – | Nov 23 | The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake,… |