https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T06:31:47.844185+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0766 certfr-2025-avi-0766 — De multiples vulnérabilités ont été découvertes dans dans les produits Liferay. Certaines d'entre elles permettent à un… 2026-10-09T06:31:47.895672+00:00 certfr-2025-avi-0766 https://cve.radiocsirt.org/vuln/euvd-2026-252252 EUVD-2026-252252 2026-10-09T06:31:47.895714+00:00 EUVD-2026-252252 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43763 fkie_cve-2025-43763 2026-10-09T06:31:47.895729+00:00

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

 https://cve.radiocsirt.org/vuln/ghsa-477q-x55m-j38g GHSA-477q-x55m-j38g — Liferay Portal is vulnerable to SSRF through custom object attachment fields 2026-10-09T06:31:47.895759+00:00

Affected: Maven: com.liferay:com.liferay.object.service

A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1990 WID-SEC-W-2025-1990 — Liferay Portal: Mehrere Schwachstellen 2026-10-09T06:31:47.895783+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen.