Litespeedtech
Litespeedtech Openlitespeed: vulnerabilidades y CVE
Litespeedtech Openlitespeed tiene 13 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses2
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-31386 | Alta (8.6) | 2.1% | — | 16 mar 2026 | OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege. |
| CVE-2021-47855 | Media (5.1) | 0.28% | — | 21 ene 2026 | Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during… |
| CVE-2025-54939 | Alta (7.5) | 0.81% | — | 1 ago 2025 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. |
| CVE-2024-31617 | Media (5.3) | 0.44% | — | 22 may 2024 | OpenLiteSpeed before 1.8.1 mishandles chunked encoding. |
| CVE-2023-40518 | Alta (7.5) | 0.65% | — | 14 ago 2023 | LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers. |
| CVE-2022-0074 | Alta (8.8) | 1.2% | — | 27 oct 2022 | Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1. |
| CVE-2022-0073 | Alta (8.8) | 8.8% | — | 27 oct 2022 | Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1. |
| CVE-2022-0072 | Media (5.8) | 1.0% | — | 27 oct 2022 | Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through… |
| CVE-2021-26758 | Alta (8.8) | 2.7% | — | 7 abr 2021 | Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system. |
| CVE-2020-5519 | Crítica (9.8) | 1.2% | — | 6 ene 2020 | The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen. |
| CVE-2018-19792 | Media (6.7) | 0.43% | — | 3 dic 2018 | The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed… |
| CVE-2018-19791 | Media (6.5) | 1.2% | — | 3 dic 2018 | The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as… |
| CVE-2015-3890 | Alta (7.5) | 1.1% | — | 20 sept 2017 | Use-after-free vulnerability in Open Litespeed before 1.3.10. |