https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:38:00.787685+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-07T01:38:00.792658+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-202133 EUVD-2026-202133 2026-10-07T01:38:00.792719+00:00 EUVD-2026-202133 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29038 fkie_cve-2021-29038 2026-10-07T01:38:00.792745+00:00

Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

 https://cve.radiocsirt.org/vuln/ghsa-mwhf-6mjm-6w3h GHSA-mwhf-6mjm-6w3h — Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers 2026-10-07T01:38:00.792795+00:00

Affected: Maven: com.liferay.portal:portal-impl, Maven: com.liferay:com.liferay.users.admin.web, Maven: com.liferay:com.liferay.login.web, Maven: com.liferay.commerce:com.liferay.commerce.account.web, Maven: com.liferay.portal:release.dxp.bom

In Liferay Impl before 5.18.4, Liferay Users Admin Web before 5.0.33, Liferay Login Web before 5.0.18, and Liferay Commerce Account Web before 3.0.7 from Liferay Portal (7.2.0 through 7.3.5), and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

 https://cve.radiocsirt.org/vuln/gsd-2021-29038 gsd-2021-29038 2026-10-07T01:38:00.792856+00:00 gsd-2021-29038 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0323 WID-SEC-W-2024-0323 — Liferay Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-07T01:38:00.792880+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Liferay Liferay Portal und Liferay Liferay DXP ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.