CVE-2026-84761

HighCVSS 7.2/10Last modified Nov 14, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Server Side Request Forgery.This issue affects LiteSpeed Cache: from n/a through 7.9.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
LiteSpeed TechnologiesLiteSpeed Cache<= 7.9

References

Timeline

Published
Sep 3, 2026
Last modified
Nov 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-847625.3Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.CVE-2026-847637.1Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.CVE-2026-847648.8Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.CVE-2026-847657.1Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.CVE-2026-847665.9Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.CVE-2026-847675.3Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.CVE-2026-847689.3Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.CVE-2026-847696.5Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.CVE-2026-84772.7Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticateCVE-2026-847708.8Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.CVE-2026-847715.3Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.CVE-2026-847725.5Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
CVE-2026-84761: High severity, CVSS 7.2 | Vulnix