https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:25:25.640931+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0766 certfr-2025-avi-0766 — De multiples vulnérabilités ont été découvertes dans dans les produits Liferay. Certaines d'entre elles permettent à un… 2026-10-08T21:25:25.644166+00:00 certfr-2025-avi-0766 https://cve.radiocsirt.org/vuln/euvd-2026-252270 EUVD-2026-252270 2026-10-08T21:25:25.644202+00:00 EUVD-2026-252270 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43778 fkie_cve-2025-43778 2026-10-08T21:25:25.644217+00:00

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.

 https://cve.radiocsirt.org/vuln/ghsa-cpg4-qcj8-42gp GHSA-cpg4-qcj8-42gp — Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin 2026-10-08T21:25:25.644247+00:00

Affected: Maven: com.liferay:com.liferay.portal.workflow.kaleo.forms.web

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1990 WID-SEC-W-2025-1990 — Liferay Portal: Mehrere Schwachstellen 2026-10-08T21:25:25.644271+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen.