Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-43802Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.Maven · com.liferay.workspace:com.liferay.ticket.workspace · fixed in 20240122.0632
- CVE-2025-43797In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through Maven · com.liferay:com.liferay.site.admin.web · fixed in 5.0.111
- CVE-2025-43798Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time passwMaven · com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web · fixed in 2.0.25
- CVE-2025-43799Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throuMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112
- CVE-2025-59154Openfire allows potential identity spoofing via unsafe CN parsingMaven · org.igniterealtime.openfire:xmppserver · fixed in 5.0.2
- CVE-2025-43800Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throuMaven · com.liferay:com.liferay.dynamic.data.mapping.form.field.type · fixed in 6.0.167
- CVE-2025-43791Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through Maven · com.liferay:com.liferay.dynamic.data.mapping.form.field.type · fixed in 6.0.167
- CVE-2025-59328Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large DataMaven · org.apache.fory:fory-core · fixed in 0.12.2
- CVE-2025-43792Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Maven · com.liferay.portal:com.liferay.portal.kernel · fixed in 130.0.1
- CVE-2025-43793Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throuMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:com.liferay.portal.kernel · fixed in 96.0.0, 130.0.1
- CVE-2025-43794Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2Maven · com.liferay.portal:com.liferay.portal.impl · fixed in 99.0.0
- CVE-2025-43795Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , Maven · com.liferay:com.liferay.configuration.admin.web, com.liferay:com.liferay.site.admin.web · fixed in 5.0.76, 5.0.103
- CVE-2025-43796Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 doMaven · com.liferay:com.liferay.portal.vulcan.api, com.liferay:com.liferay.portal.vulcan.impl · fixed in 40.2.0, 5.0.105
- CVE-2025-43787A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 202Maven · com.liferay:com.liferay.users.admin.web · fixed in 11.0.33
- CVE-2025-43788The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through Maven · com.liferay:com.liferay.organizations.item.selector.web · fixed in 4.0.22
- CVE-2025-43789JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 publishedMaven · com.liferay:com.liferay.comment.web · fixed in 6.1.4
- CVE-2025-43790Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6Maven · com.liferay:com.liferay.object.service · fixed in 1.0.197
- CVE-2025-43782Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7Maven · com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl · fixed in 5.0.48
- CVE-2025-43783Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1Maven · com.liferay:com.liferay.frontend.editor.ckeditor.web · fixed in 5.0.102
- CVE-2025-43784Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 thrMaven · com.liferay:com.liferay.headless.builder.impl · fixed in 1.0.32
- CVE-2025-43785Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 2024.Q3.0, 2024.Q1.13, 7.4.3.129 and more
- CVE-2025-43786Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 throuMaven · com.liferay:com.liferay.headless.admin.workflow.impl, com.liferay:com.liferay.portal.vulcan.impl +1 · fixed in 5.0.83, 5.0.127, 11.0.1
- CVE-2025-43781Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.Maven · com.liferay:com.liferay.portal.search.web · fixed in 6.0.143
- CVE-2025-43775Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024Maven · com.liferay:com.liferay.client.extension.web · fixed in 2.0.27
- CVE-2025-43776A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 2024.Q1.20, 2025.Q1.17, 2025.Q2.10 and more
- CVE-2025-43777Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.QMaven · com.liferay:com.liferay.portal.security.sso.openid.connect.impl · fixed in 7.0.48
- CVE-2025-43778A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 20Maven · com.liferay:com.liferay.portal.workflow.kaleo.forms.web · fixed in 5.0.107
- CVE-2025-43763A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2Maven · com.liferay:com.liferay.object.service · fixed in 1.0.208
- CVE-2025-58365XWiki Blog Application: Privilege Escalation (PR) from account through blog contentMaven · org.xwiki.contrib.blog:application-blog-ui · fixed in 9.14
- CVE-2025-58782Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactoryMaven · org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-jcr-commons · fixed in 2.22.2