https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:08:32.783260+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0815 certfr-2025-avi-0815 — Une vulnérabilité a été découverte dans Liferay. Elle permet à un attaquant de provoquer un contournement de la politiq… 2026-10-07T18:08:32.786782+00:00 certfr-2025-avi-0815 https://cve.radiocsirt.org/vuln/euvd-2026-253355 EUVD-2026-253355 2026-10-07T18:08:32.786817+00:00 EUVD-2026-253355 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43819 fkie_cve-2025-43819 2026-10-07T18:08:32.786832+00:00

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API

 https://cve.radiocsirt.org/vuln/ghsa-rpx3-f938-xj5q GHSA-rpx3-f938-xj5q — Liferay Portal and DXP does not properly expire sessions 2026-10-07T18:08:32.786861+00:00

Affected: Maven: com.liferay:com.liferay.saml.impl

### Summary

Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.

### Affected Versions

The following platform versions are affected:

* **Liferay Portal:** * `7.3.3.131` through `7.4.3.121` * **Liferay DXP:** * `2024.Q4.0`–`2024.Q4.3` * `2024.Q3.1`–`2024.Q3.13` * `2024.Q2.0`–`2024.Q2.13` * `2024.Q1.1`–`2024.Q1.12`

### Remediation

Update to the fixed builds and, for Maven consumers of the SAML module, upgrade `com.liferay:com.liferay.saml.impl` to **5.0.51** or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2118 WID-SEC-W-2025-2118 — Liferay Portal: Mehrere Schwachstellen 2026-10-07T18:08:32.786903+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross Site Scripting durchzuführen und Benutzerrechte erlangen.