https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:29:15.262689+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 — De multiples vulnérabilités ont été découvertes dans Liferay. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-04T21:29:15.313631+00:00 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-257428 EUVD-2026-257428 2026-10-04T21:29:15.313674+00:00 EUVD-2026-257428 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62275 fkie_cve-2025-62275 2026-10-04T21:29:15.313689+00:00

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

 https://cve.radiocsirt.org/vuln/ghsa-xf7m-v66q-76w8 GHSA-xf7m-v66q-76w8 — Liferay Portal and DXP do not check permissions of images in a blog entry 2026-10-04T21:29:15.313719+00:00

Affected: Maven: com.liferay:com.liferay.blogs.item.selector.web

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2470 WID-SEC-W-2025-2470 — Liferay Portal und DXP: Mehrere Schwachstellen 2026-10-04T21:29:15.313743+00:00

Ein Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Informationen einzusehen oder Daten zu manipulieren.