https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T19:08:27.636857+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0912 certfr-2024-avi-0912 — De multiples vulnérabilités ont été découvertes dans Liferay. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-06T19:08:27.641543+00:00 certfr-2024-avi-0912 https://cve.radiocsirt.org/vuln/euvd-2026-254707 EUVD-2026-254707 2026-10-06T19:08:27.641599+00:00 EUVD-2026-254707 https://cve.radiocsirt.org/vuln/fkie_cve-2024-38002 fkie_cve-2024-38002 2026-10-06T19:08:27.641621+00:00

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

 https://cve.radiocsirt.org/vuln/ghsa-3mfq-fp2f-vwqh GHSA-3mfq-fp2f-vwqh — Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions 2026-10-06T19:08:27.641665+00:00

Affected: Maven: com.liferay.portal:release.portal.bom, Maven: com.liferay.portal:release.dxp.bom

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3252 WID-SEC-W-2024-3252 — Liferay DXP und Portal: Mehrere Schwachstellen 2026-10-06T19:08:27.641707+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay DXP und Liferay Portal ausnutzen, um Administratorrechte zu erlangen Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder beliebigen Code auszuführen.