https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:26:14.905868+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0811 certfr-2025-avi-0811 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-06T16:26:14.909112+00:00 certfr-2025-avi-0811 https://cve.radiocsirt.org/vuln/euvd-2026-253304 EUVD-2026-253304 2026-10-06T16:26:14.909147+00:00 EUVD-2026-253304 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43806 fkie_cve-2025-43806 2026-10-06T16:26:14.909161+00:00

Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.

 https://cve.radiocsirt.org/vuln/ghsa-pm45-xx4q-fmv7 GHSA-pm45-xx4q-fmv7 — Liferay Portal and DXP does not properly check permission with import and export tasks 2026-10-06T16:26:14.909190+00:00

Affected: Maven: com.liferay:com.liferay.headless.batch.engine.impl, Maven: com.liferay:com.liferay.batch.engine.service

Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2106 WID-SEC-W-2025-2106 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-06T16:26:14.909215+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen und Daten zu manipulieren.