litespeedtech LiteSpeed Web Server

• CVE-2026-93903 Critical 9.4 LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting a low-privileged tenant execute code in t 0.4%