https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:29:02.372289+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0713 certfr-2025-avi-0713 — De multiples vulnérabilités ont été découvertes dans les produits Liferay. Certaines d'entre elles permettent à un atta… 2026-10-05T22:29:02.375536+00:00 certfr-2025-avi-0713 https://cve.radiocsirt.org/vuln/euvd-2026-250177 EUVD-2026-250177 2026-10-05T22:29:02.375572+00:00 EUVD-2026-250177 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43738 fkie_cve-2025-43738 2026-10-05T22:29:02.375587+00:00

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

 https://cve.radiocsirt.org/vuln/ghsa-cwgh-r52j-xh6c GHSA-cwgh-r52j-xh6c — Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter 2026-10-05T22:29:02.375615+00:00

Affected: Maven: com.liferay:com.liferay.expando.web

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Liferay Portal is fixed on the master branch from commit acc4771.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1865 WID-SEC-W-2025-1865 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-05T22:29:02.375640+00:00

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross-Site-Scripting- und Phishing-Angriffe zu starten und vertrauliche Informationen offenzulegen.