# com.liferay.portal:com.liferay.portal.kernel (Maven) vulnerabilities 6 known vulnerabilities (1 critical, 2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 166.0.0 (Jul 13, 2025): no advisory affects it - Newest unaffected release: 166.0.0 (Jul 13, 2025), the latest release - Dependents: 14 - Releases: 500+ since 2.144.3 (Nov 3, 2020) - Registry: https://central.sonatype.com/artifact/com.liferay.portal/com.liferay.portal.kernel - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-43792: 2.144.3 to 130.0.0 (130.0.1 is outside it) - CVE-2025-43793: 2.144.3 to 130.0.0 (130.0.1 is outside it) - CVE-2025-43770: 2.144.3 to 154.0.0 (155.0.0 is outside it) - CVE-2025-3526: 2.144.3 to 37.0.0 (38.0.0 is outside it) - CVE-2024-25607: 2.144.3 to 37.0.0 (38.0.0 is outside it) - CVE-2020-7961: 2.144.3 to 3.132.1 (4.71.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (6) ### [CVE-2025-43792](https://cve.now/CVE-2025-43792): Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through… - Severity: Low 2.3 - Published: Sep 15, 2025 - Affected: fixed in 130.0.1. - Fixed in 130.0.1 (released Dec 7, 2023, 648 days before disclosure). - The latest release, 166.0.0, is not affected. ### [CVE-2025-43793](https://cve.now/CVE-2025-43793): Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA… - Severity: Medium 6.9 - Published: Sep 15, 2025 - Affected: fixed in 130.0.1. - Fixed in 130.0.1 (released Dec 7, 2023, 648 days before disclosure). - The latest release, 166.0.0, is not affected. ### [CVE-2025-43770](https://cve.now/CVE-2025-43770): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through… - Severity: Medium 6.9 - Published: Aug 23, 2025 - Affected: fixed in 155.0.0. - Fixed in 155.0.0 (released Jan 15, 2025, 220 days before disclosure). - The latest release, 166.0.0, is not affected. ### [CVE-2025-3526](https://cve.now/CVE-2025-3526): SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older… - Severity: High 8.7 - Published: Jun 16, 2025 - Affected: fixed in 38.0.0. - Fixed in 38.0.0 (released Feb 23, 2022, 1209 days before disclosure). - The latest release, 166.0.0, is not affected. ### [CVE-2024-25607](https://cve.now/CVE-2024-25607): The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and… - Severity: High 8.1 - Published: Feb 20, 2024 - Affected: fixed in 38.0.0. - Fixed in 38.0.0 (released Feb 23, 2022, 727 days before disclosure). - The latest release, 166.0.0, is not affected. ### [CVE-2020-7961](https://cve.now/CVE-2020-7961): Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser - Severity: Critical 9.8 · KEV - Published: Mar 20, 2020 - Affected: fixed in 4.35.3. - Fixed in 4.71.1 (released Nov 7, 2020, 232 days after disclosure, the advisory names 4.35.3, which was never published). - The latest release, 166.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.liferay.portal:com.liferay.portal.kernel Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.