MavenPackage

com.liferay.portal:com.liferay.portal.kernel

6 known vulnerabilities (1 critical, 2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 166.0.0 (Jul 13, 2025): no advisory affects it
Newest unaffected release: 166.0.0 (Jul 13, 2025), the latest release
Advisories: 6 · 1 critical, 2 high, 2 medium, 1 low

Dependents: 14
Releases: 500+ since 2.144.3 (Nov 3, 2020)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-43792
Affects 2.144.3 to 130.0.0 (130.0.1 is outside it)
CVE-2025-43793
Affects 2.144.3 to 130.0.0 (130.0.1 is outside it)
CVE-2025-43770
Affects 2.144.3 to 154.0.0 (155.0.0 is outside it)
CVE-2025-3526
Affects 2.144.3 to 37.0.0 (38.0.0 is outside it)
CVE-2024-25607
Affects 2.144.3 to 37.0.0 (38.0.0 is outside it)
CVE-2020-7961
Affects 2.144.3 to 3.132.1 (4.71.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 6

CVE-2025-43792Low 2.3
Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through…
Affected: fixed in 130.0.1.
Fixed in 130.0.1 (released Dec 7, 2023, 648 days before disclosure).
The latest release, 166.0.0, is not affected.
CVE-2025-43793Medium 6.9
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA…
Affected: fixed in 130.0.1.
Fixed in 130.0.1 (released Dec 7, 2023, 648 days before disclosure).
The latest release, 166.0.0, is not affected.
CVE-2025-43770Medium 6.9
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through…
Affected: fixed in 155.0.0.
Fixed in 155.0.0 (released Jan 15, 2025, 220 days before disclosure).
The latest release, 166.0.0, is not affected.
CVE-2025-3526High 8.7
SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older…
Affected: fixed in 38.0.0.
Fixed in 38.0.0 (released Feb 23, 2022, 1209 days before disclosure).
The latest release, 166.0.0, is not affected.
CVE-2024-25607High 8.1
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and…
Affected: fixed in 38.0.0.
Fixed in 38.0.0 (released Feb 23, 2022, 727 days before disclosure).
The latest release, 166.0.0, is not affected.
CVE-2020-7961Critical 9.8 · KEV
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser
Affected: fixed in 4.35.3.
Fixed in 4.71.1 (released Nov 7, 2020, 232 days after disclosure, the advisory names 4.35.3, which was never published).
The latest release, 166.0.0, is not affected.