https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:17:03.527133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-19509 cnvd-2022-19509 2026-10-09T15:17:03.530353+00:00 cnvd-2022-19509 https://cve.radiocsirt.org/vuln/euvd-2026-334482 EUVD-2026-334482 2026-10-09T15:17:03.530389+00:00 EUVD-2026-334482 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25146 fkie_cve-2022-25146 2026-10-09T15:17:03.530404+00:00

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

 https://cve.radiocsirt.org/vuln/ghsa-ghw5-998m-vw4w GHSA-ghw5-998m-vw4w — Liferay Portal and Liferay DXP fails to check origin of event messages 2026-10-09T15:17:03.530432+00:00

Affected: Maven: com.liferay:com.liferay.remote.app.web, Maven: com.liferay.portal:release.dxp.bom

The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

 https://cve.radiocsirt.org/vuln/gsd-2022-25146 gsd-2022-25146 2026-10-09T15:17:03.530458+00:00 gsd-2022-25146