Vulnerabilities
Summary — last 7 days
New vulnerabilities3,340▲ 436 vs. last week
Critical / high1,491▲ 179 vs. last week
New active exploitation (KEV)7▼ 3 vs. last week
Unscored (no CVSS)592▲ 119 vs. last week
318 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | Medium (4.8) | 0.24% | — | Liferay Digital Experience PlatformLiferay Portal | 10/22/2025 | 6/17/2026 | A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1… | |
| Analyzed | Medium (6.9) | 0.25% | — | Liferay Digital Experience PlatformLiferay Portal | 10/21/2025 | 6/17/2026 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through… | |
| Analyzed | Medium (6.9) | 0.17% | — | Liferay Digital Experience PlatformLiferay Portal | 10/21/2025 | 6/17/2026 | Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0… | |
| Analyzed | Medium (4.8) | 0.27% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being… | |
| Analyzed | Medium (5.3) | 0.27% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary… | |
| Analyzed | Medium (5.3) | 0.30% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different… | |
| Analyzed | Medium (5.3) | 0.27% | — | Liferay Digital Experience Platform | 10/13/2025 | 6/17/2026 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the… | |
| Analyzed | Medium (5.3) | 0.24% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the… | |
| Analyzed | Medium (4.8) | 0.29% | — | Liferay Digital Experience PlatformLiferay Portal | 10/13/2025 | 6/17/2026 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a… | |
| Analyzed | Medium (5.1) | 0.19% | — | Liferay Digital Experience PlatformLiferay Portal | 10/10/2025 | 6/17/2026 | Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments. | |
| Analyzed | Medium (4.6) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/10/2025 | 6/17/2026 | Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/10/2025 | 6/17/2026 | Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/10/2025 | 6/17/2026 | Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/9/2025 | 6/17/2026 | Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or… | |
| Analyzed | Medium (4.8) | 0.21% | — | Liferay Digital Experience PlatformLiferay Portal | 10/8/2025 | 6/17/2026 | Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s… | |
| Analyzed | Medium (5.1) | 0.24% | — | Liferay Digital Experience PlatformLiferay Portal | 10/8/2025 | 6/17/2026 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/8/2025 | 6/17/2026 | Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/8/2025 | 6/17/2026 | Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/7/2025 | 6/17/2026 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 10/7/2025 | 6/17/2026 | Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a… | |
| Analyzed | Medium (4.8) | 0.23% | — | Liferay Digital Experience PlatformLiferay Portal | 10/6/2025 | 6/17/2026 | The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated… | |
| Analyzed | Medium (4.6) | 0.30% | — | Liferay Digital Experience PlatformLiferay Portal | 10/3/2025 | 6/17/2026 | A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows… | |
| Analyzed | Medium (4.8) | 0.22% | — | Liferay Digital Experience PlatformLiferay Portal | 9/30/2025 | 6/17/2026 | Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject… | |
| Analyzed | Medium (5.3) | 0.29% | — | Liferay Digital Experience PlatformLiferay Portal | 9/30/2025 | 6/17/2026 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows… |