Recent KEV Additions: LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager, and Splunk Enterprise
NEOSEC enrichment — no mirror of the original source
In the past week, the US Cybersecurity and Infrastructure Security Agency (CISA) has added four CVEs to the Known Exploited Vulnerabilities (KEV) catalog; of those, three have been assigned three-day mitigation deadlines for Federal Civilia
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Dukes, Neely.
Linked advisories
- CVE-2026-48907Widget Factory Joomla Content Editor: Schwachstelle ermöglicht Codeausführung
- CVE-2026-48907Widget Factory Joomla Content Editor — Widget Factory Joomla Content Editor Improper Access Control Vulnerability
- CVE-2026-20253Splunk Enterprise: fehlende Authentifizierung für kritische Funktion
- CVE-2026-54420LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
- CVE-2026-20262Cisco SD-WAN Manager: Schwachstelle ermöglicht Manipulation von Dateien
- CVE-2026-20262Cisco Catalyst SD-WAN Manager: Pfadüberschreitung (Path Traversal)
- CVE-2026-20262Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
- CVE-2026-20253Splunk Enterprise: Mehrere Schwachstellen
- CVE-2026-48907widgetfactorylimited jce: unzureichende Zugriffskontrolle
- CVE-2026-20253Splunk Enterprise — Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Affected vendors and products
More on LiteSpeed
Other advisories
- MediumCVE-2026-114190Hai Zheng / Lite Speed Cache LiteSpeed Cache: vertrauliche Informationen in übertragenen Daten
- MediumCVE-2026-114190Hai Zheng / Lite Speed Cache LiteSpeed Cache: vertrauliche Informationen in übertragenen Daten
- LowCVE-2026-113501LiteSpeed Cache: fehlende Autorisierung
- HighCVE-2026-113500LiteSpeed Cache: Cross-Site-Scripting (XSS)
- HighCVE-2026-113499LiteSpeed Cache: Cross-Site-Scripting (XSS)
- LowCVE-2026-113501LiteSpeed Cache: fehlende Autorisierung
- HighCVE-2026-113500LiteSpeed Cache: Cross-Site-Scripting (XSS)
- HighCVE-2026-113499LiteSpeed Cache: Cross-Site-Scripting (XSS)
Other news entries
- LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared ServerNewsThe Hacker News
- Joomla, LiteSpeed Vulnerabilities Exploited in AttacksNewsSecurityWeek
- CISA warns of another cPanel plugin flaw exploited in attacksNewsBleepingComputer
- CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege EscalationNewsThe Hacker News
- LiteSpeed cPanel Plugin Privilege Escalation ExploitedVulnerabilitySANS NewsBites
- CISA gives feds 4 days to patch actively exploited cPanel plugin flawNewsBleepingComputer
- LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as RootNewsThe Hacker News
- Root-Attacken auf Cisco Catalyst SD-WAN Manager und cPanel-Plug-in LiteSpeedNewsheise Security
ID