4
CVEs
1
Critical
3
High
2
KEV
2
PoC
2
Unpatched C/H
50.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48172 | Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers abuse the plugin's Redis enable/disable functionality (the redisAble cpanel_jsonapi_func) to gain elevated, potentially root-level, access on the cPanel host. This flaw is confirmed actively exploited (CISA KEV) with in-the-wild activity observed in May 2026, publicly available exploit code exists (including a GitHub PoC), and the vendor scores it CVSS 4.0 10.0. Notably, the parent LiteSpeed WHM Plugin is not affected - only the end-user cPanel plugin. | CRITICAL | 10.0 | 0.0% | 120 |
KEV
PoC
|
| CVE-2026-54420 | Symlink mishandling in LiteSpeed cPanel Plugin before 2.4.8 (and the bundling LiteSpeed WHM PlugIn before 5.3.2.0) lets a low-privileged tenant on a shared CloudLinux/CageFS host escape their per-user filesystem jail by planting symlinks the plugin follows with elevated privileges. The CVE record states the flaw was exploited against shared hosting providers in May 2026, and CVSS 8.5 with Scope:Changed reflects cross-tenant compromise of other customers' files on the same server. No separate KEV listing or public POC is present in the provided intelligence. | HIGH | 8.5 | 0.1% | 113 |
KEV
PoC
|
| CVE-2026-31386 | OS command injection in OpenLiteSpeed and LSWS Enterprise web servers from LiteSpeed Technologies allows administrative users to execute arbitrary operating system commands on the host. The flaw affects all versions of both products per ENISA EUVD and was reported by JPCERT/CC via JVN. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 37th percentile), but the high CVSS 4.0 score (8.6) reflects full confidentiality, integrity, and availability impact on the underlying host. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2026-84761 | Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation. | HIGH | 7.2 | 0.2% | 36 |
No patch
|