https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:49:56.439597+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-05T12:49:56.443540+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-159776 EUVD-2026-159776 2026-10-05T12:49:56.443579+00:00 EUVD-2026-159776 https://cve.radiocsirt.org/vuln/fkie_cve-2024-25609 fkie_cve-2024-25609 2026-10-05T12:49:56.443594+00:00

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.

 https://cve.radiocsirt.org/vuln/ghsa-3qq5-wcrx-4h8r GHSA-3qq5-wcrx-4h8r — Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes 2026-10-05T12:49:56.443626+00:00

Affected: Maven: com.liferay.portal:release.portal.bom, Maven: com.liferay.portal:release.dxp.bom

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.

 https://cve.radiocsirt.org/vuln/gsd-2024-25609 gsd-2024-25609 2026-10-05T12:49:56.443655+00:00 gsd-2024-25609 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0440 WID-SEC-W-2024-0440 — Liferay Portal und Liferay DXP: Mehrere Schwachstellen 2026-10-05T12:49:56.443667+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff zu starten, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.