https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:41:07.349606+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0793 certfr-2025-avi-0793 — De multiples vulnérabilités ont été découvertes dans Liferay. Certaines d'entre elles permettent à un attaquant de prov… 2026-10-04T03:41:07.352846+00:00 certfr-2025-avi-0793 https://cve.radiocsirt.org/vuln/euvd-2026-252671 EUVD-2026-252671 2026-10-04T03:41:07.352881+00:00 EUVD-2026-252671 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43793 fkie_cve-2025-43793 2026-10-04T03:41:07.352896+00:00

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the application.

 https://cve.radiocsirt.org/vuln/ghsa-xvgg-9h29-4g34 GHSA-xvgg-9h29-4g34 — Liferay Portal has Improper Validation of Specified Quantity in Input 2026-10-04T03:41:07.352923+00:00

Affected: Maven: com.liferay.portal:com.liferay.portal.impl, Maven: com.liferay.portal:com.liferay.portal.kernel

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the application.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2064 WID-SEC-W-2025-2064 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-04T03:41:07.352949+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay DXP und Liferay Portal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.