com.liferay.portal:release.portal.bom vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62264Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter CVE-2025-62265Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to XSS in the Blogs widget CVE-2025-62266Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to DNS rebinding attacks CVE-2025-62257Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to password enumeration CVE-2025-62258Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to CSRF in Headless APIs CVE-2025-62260Highcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to DoS via Crafted Headless API Request CVE-2025-62259Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Does Not Limit Access to APIs Before Email Verification CVE-2025-62261Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Stores Password Reset Tokens in Plain Text CVE-2025-43830Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to Stored XSS through Forms text type field CVE-2025-43823Mediumcom.liferay.portal:release.portal.bom: Liferay Portal is vulnerable to XSS through its Commerce Search Result widget CVE-2025-43822Mediumcom.liferay.portal:release.portal.bom: Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page CVE-2025-43824Mediumcom.liferay.portal:release.portal.bom: Liferay Profile Widget does not prevent vCard extension spoofing CVE-2025-43826Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to XSS in Web Content translation CVE-2025-43812Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to cross-site scripting in the web content template CVE-2025-43820Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to cross-site scripting in the Calendar widget CVE-2025-43817Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter CVE-2025-43813Mediumcom.liferay.portal:release.portal.bom: Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet CVE-2025-43799Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Uses Default Password CVE-2025-43785Mediumcom.liferay.portal:release.portal.bom: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting CVE-2025-43776Mediumcom.liferay.portal:release.portal.bom: Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting CVE-2025-43760Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect CVE-2025-43752Mediumcom.liferay.portal:release.portal.bom: Liferay Portal's Unlimited File Upload Could Result in DoS CVE-2025-43754Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Username Enumeration Vulnerability CVE-2025-43756Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter CVE-2025-43746Mediumcom.liferay.portal:release.portal.bom: Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo