https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T23:38:41.390617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0672 certfr-2025-avi-0672 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une falsific… 2026-10-20T23:38:41.393820+00:00 certfr-2025-avi-0672 https://cve.radiocsirt.org/vuln/euvd-2026-249426 EUVD-2026-249426 2026-10-20T23:38:41.393855+00:00 EUVD-2026-249426 https://cve.radiocsirt.org/vuln/fkie_cve-2025-4581 fkie_cve-2025-4581 2026-10-20T23:38:41.393870+00:00

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

 https://cve.radiocsirt.org/vuln/ghsa-6v93-frf9-2rp8 GHSA-6v93-frf9-2rp8 — Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery 2026-10-20T23:38:41.393898+00:00

Affected: Maven: com.liferay.portal:release.portal.bom, Maven: com.liferay.portal:release.dxp.bom

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1752 WID-SEC-W-2025-1752 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-20T23:38:41.393928+00:00

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um eine Cross-Site-Scripting- Angriff durchzuführen, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.