Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Oct 2, 2026OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writableCVE-2026-104474 · Other software · litespeedtech · reported by VulnCheckMedium 5.4
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.
- Product
- openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.CVE-2026-31386 · Other software · LiteSpeed Technologies · reported by vultures@jpcert.or.jpHigh 8.6
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
- Product
- OpenLiteSpeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpopenlitespeed.org
Jan 21, 2026Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripCVE-2021-47855 · Other software · LiteSpeed Technologies · reported by VulnCheckMedium 5.1
Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on the Default Icon.
- Product
- OpenLiteSpeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenlitespeed.orgexploit-db.com
May 22, 2024OpenLiteSpeed before 1.8.1 mishandles chunked encoding.CVE-2024-31617 · Other software · litespeedtech · reported by MITREMedium 5.3
OpenLiteSpeed before 1.8.1 mishandles chunked encoding.
- Product
- openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.CVE-2023-40518 · Other software · Litespeedtech · reported by MITREHigh 7.5
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenlitespeed.orglitespeedtech.com
Oct 27, 2022Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation.CVE-2022-0074 · Other software · LiteSpeed Technologies · reported by psirt@paloaltonetworks.comHigh 8.8
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.
- Product
- OpenLiteSpeed Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection.CVE-2022-0073 · Other software · LiteSpeed Technologies · reported by psirt@paloaltonetworks.comHigh 8.8
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.
- Product
- OpenLiteSpeed Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal.CVE-2022-0072 · Other software · LiteSpeed Technologies · reported by psirt@paloaltonetworks.comMedium 5.8
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1
- Product
- OpenLiteSpeed Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2021Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the CVE-2021-26758 · Other software · Litespeedtech · reported by MITREHigh 8.8
Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unsafe-inline.comgithub.com
Jan 6, 2020The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.CVE-2020-5519 · Other software · Litespeedtech · reported by MITRECritical 9.8
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comforum.openlitespeed.org
Dec 3, 2018The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impaCVE-2018-19792 · Other software · Litespeedtech · reported by MITREMedium 6.7
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size CVE-2018-19791 · Other software · Litespeedtech · reported by MITREMedium 6.5
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2017Use-after-free vulnerability in Open Litespeed before 1.3.10.CVE-2015-3890 · Other software · Litespeedtech · reported by MITREHigh 7.5
Use-after-free vulnerability in Open Litespeed before 1.3.10.
- Product
- Openlitespeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-assessment.comsecurity-assessment.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.