Liferay Security Advisories Liferay Security Advisories https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/rss 2026-09-12T01:26:20Z 2026-09-12T01:26:20Z CVE-2025-62275 Blogs images are visible to unauthenticated users Alex Candido https://liferay.dev/w/cve-2025-62275-1?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T04:49:18Z 2025-10-31T14:44:00Z Alex Candido 2025-10-31T14:44:00Z CVE-2025-62276 Private Cache-Control header for DM and AM file download Alex Candido https://liferay.dev/w/cve-2025-62276?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T04:50:48Z 2025-10-31T11:38:00Z Alex Candido 2025-10-31T11:38:00Z CVE-2025-62261 Cleartext storage of password reset tickets Alex Candido https://liferay.dev/w/cve-2025-62261?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T05:09:45Z 2025-10-27T09:09:00Z Alex Candido 2025-10-27T09:09:00Z CVE-2025-62262 Email address in LDAP import logs Alex Candido https://liferay.dev/w/cve-2025-62262?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T05:11:44Z 2025-10-27T08:35:00Z Alex Candido 2025-10-27T08:35:00Z CVE-2025-62255 Self-XSS with attachment file names in Knowledge Base Alex Candido https://liferay.dev/w/cve-2025-62255?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T05:14:36Z 2025-10-23T18:43:00Z Alex Candido 2025-10-23T18:43:00Z CVE-2025-62254 Very large ComboServlet responses Alex Candido https://liferay.dev/w/cve-2025-62254?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T05:13:47Z 2025-10-23T10:11:00Z Alex Candido 2025-10-23T10:11:00Z CVE-2025-43816 Memory leak when consuming the headless API for StructuredContents Alex Candido https://liferay.dev/w/cve-2025-43816?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-14T04:08:26Z 2025-09-25T08:04:00Z Alex Candido 2025-09-25T08:04:00Z CVE-2025-43809 CSRF vulnerability with server (license) registration Alex Candido https://liferay.dev/w/cve-2025-43809?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-14T04:13:21Z 2025-09-19T07:23:00Z Alex Candido 2025-09-19T07:23:00Z CVE-2025-62250 Portal fails to verify messages from the cluster network is trusted Alex Candido https://liferay.dev/w/cve-2025-62250?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-13T05:18:56Z 2025-05-08T17:23:00Z Alex Candido 2025-05-08T17:23:00Z CVE-2025-43799 Change password requirement bypass Evanilson Santana https://liferay.dev/w/cve-2025-43799?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T00:12:15Z 2024-11-11T19:56:00Z Evanilson Santana 2024-11-11T19:56:00Z CVE-2023-37940 XSS with `Service Class` in Service Access Policy Evanilson Santana https://liferay.dev/w/cve-2023-37940?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T07:11:09Z 2024-10-30T13:14:00Z Evanilson Santana 2024-10-30T13:14:00Z CVE-2025-62253 Open redirect in page administration Evanilson Santana https://liferay.dev/w/cve-2025-62253?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T00:15:32Z 2024-10-25T19:04:00Z Evanilson Santana 2024-10-25T19:04:00Z CVE-2025-3526 DoS vulnerability with SessionClicks Evanilson Santana https://liferay.dev/w/cve-2025-3526?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T06:26:33Z 2024-10-07T16:23:00Z Evanilson Santana 2024-10-07T16:23:00Z CVE-2025-3594 DoS vulnerability with SessionClicks Alex Candido https://liferay.dev/w/cve-2025-3594?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-06-11T04:03:14Z 2024-10-07T16:23:00Z Alex Candido 2024-10-07T16:23:00Z CVE-2025-43748 Insufficient CSRF protection for omni-administrator actions Evanilson Santana https://liferay.dev/w/cve-2025-43748?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T06:26:33Z 2024-10-01T20:06:00Z Evanilson Santana 2024-10-01T20:06:00Z CVE-2024-8980 Mitigate against simple XSS attacks against script console Evanilson Santana https://liferay.dev/w/cve-2024-8980?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T00:15:32Z 2024-09-18T12:57:00Z Evanilson Santana 2024-09-18T12:57:00Z CVE-2025-62259 Email address verification bypass Evanilson Santana https://liferay.dev/w/cve-2025-62259?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T00:15:32Z 2024-09-17T13:57:00Z Evanilson Santana 2024-09-17T13:57:00Z CVE-2023-42628 XSS with child wiki pages Samuel Kong https://liferay.dev/w/cve-2023-42628?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-15T06:27:54Z 2023-10-13T11:50:00Z Samuel Kong 2023-10-13T11:50:00Z CVE-2023-33949 Users do not have to verify their email address by default Samuel Kong https://liferay.dev/w/cve-2023-33949?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss 2026-05-14T06:57:41Z 2023-05-24T07:00:00Z Samuel Kong 2023-05-24T07:00:00Z