https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:16:26.722617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-05T14:16:26.779018+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-254327 EUVD-2026-254327 2026-10-05T14:16:26.779075+00:00 EUVD-2026-254327 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43824 fkie_cve-2025-43824 2026-10-05T14:16:26.779103+00:00

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.

 https://cve.radiocsirt.org/vuln/ghsa-pfxj-gvqg-mj44 GHSA-pfxj-gvqg-mj44 — Liferay Profile Widget does not prevent vCard extension spoofing 2026-10-05T14:16:26.779151+00:00

Affected: Maven: com.liferay.portal:release.portal.bom

The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2214 WID-SEC-W-2025-2214 — Liferay Portal: Schwachstelle ermöglicht Manipulation von Daten 2026-10-05T14:16:26.779191+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um Daten zu manipulieren.