Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2751▲ 28 respecto a la semana anterior

Críticas / altas1468▲ 334 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)85▼ 441 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-93903	Pendiente de análisis	Crítica (9.4)	0.26%	—	Litespeed WEB Server^AI	30/9/2026	30/9/2026	LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
CVE-2026-31386	Analizada	Alta (8.6)	2.1%	—	Litespeedtech Litespeed WEB Server Litespeedtech Openlitespeed	16/3/2026	17/6/2026	OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
CVE-2025-54939	Analizada	Alta (7.5)	0.80%	—	Litespeedtech Litespeed WEB ADC Litespeedtech Litespeed WEB Server Litespeedtech Lsquic Litespeedtech Openlitespeed	1/8/2025	17/6/2026	LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.
CVE-2012-4871	Modificada	Media (4.3)	1.6%	—	Litespeedtech Litespeed WEB Server	6/9/2012	16/6/2026	Cross-site scripting (XSS) vulnerability in service/graph_html.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the gtitle parameter.
CVE-2010-2333	Modificada	Media (5)	60%	—	Litespeedtech Litespeed WEB Server	18/6/2010	16/6/2026	LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a null byte followed by a .txt file extension.
CVE-2007-5654	Modificada	Media (5)	41%	—	Litespeed Technologies Litespeed WEB Server	23/10/2007	16/6/2026	LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."
CVE-2005-3695	Modificada	Media (4.3)	1.9%	—	Litespeed Technologies Litespeed WEB Server	20/11/2005	16/6/2026	Cross-site scripting (XSS) vulnerability in admin/config/confMgr.php in LiteSpeed Web Server 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the m parameter.
CVE-2004-0081	Modificada	Media (5)	7.2%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+62	23/11/2004	16/6/2026	OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.
CVE-2004-0079	Modificada	Alta (7.5)	9.5%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+62	23/11/2004	16/6/2026	The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
CVE-2004-0112	Modificada	Media (5)	10%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+61	23/11/2004	16/6/2026	The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.