Liferay Portal

Name: Liferay Portal
Brand: Liferay

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical25high175medium2low

updated 2026-10-28

vulnerabilities (210)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-3639US	—OT elevated	0.50% (43rd)	Exploit	no fix	2025-08-18	≤ 7.3.0 ≤7.4.3.132
CVE-2025-4388US	medium6.1	3.75% (90th)	—	5.0.50	2025-05-06	3 versions
CVE-2023-42627US	medium5.4	2.79% (86th)	—	no fix	2023-10-17	≤ 7.3.5 ≤7.4.3.91
CVE-2023-42628US	medium5.4	2.78% (86th)	—	no fix	2023-10-17	≤ 7.1.0 ≤7.4.3.87
CVE-2023-42629US	medium5.4	2.78% (86th)	—	no fix	2023-10-17	≤ 7.4.2 ≤7.4.3.87
CVE-2024-25608US	medium6.1	0.97% (62nd)	—	no fix	2024-02-20	2 versions
CVE-2023-33950US	high7.5	0.92% (60th)	—	no fix	2023-05-24	≤ 7.4.3.48 ≤7.4.3.76
CVE-2023-33949US	high7.5OT elevated	0.82% (57th)	—	no fix	2023-05-24	≤ 0 ≤7.3.0
CVE-2023-33948US	high7.5OT elevated	0.74% (55th)	—	no fix	2023-05-24	≤ 7.4.3.67
CVE-2024-26265US	medium6.5	0.71% (53rd)	—	7.4.3.14	2024-02-20	6 versions
CVE-2024-25143US	medium6.5	0.69% (53rd)	—	7.3.6	2024-02-07	4 versions
CVE-2025-3594US	critical9.8	0.68% (52nd)	—	7.4.3.98	2025-06-16	4 versions
CVE-2023-47797US	medium6.1	0.65% (51st)	—	no fix	2023-11-17	≤ 7.4.3.94 ≤7.4.3.95
CVE-2024-38002US	high8.8OT elevated	0.65% (51st)	—	7.4.3.108	2024-10-22	6 versions
CVE-2025-3526US	high7.5	0.64% (51st)	—	7.4.3.22	2025-06-16	4 versions
CVE-2023-40191US	medium6.1	0.62% (50th)	—	7.4.3.26	2024-02-21	4 versions
CVE-2023-47795US	medium5.4	0.61% (49th)	—	no fix	2024-02-21	≤ 7.4.3.18 ≤7.4.3.101
CVE-2024-25602US	medium5.4	0.61% (49th)	—	7.4.3.26	2024-02-21	5 versions
CVE-2023-42498US	medium6.1	0.61% (49th)	—	7.4.3.16	2024-02-21	4 versions
CVE-2023-42496US	medium6.1	0.61% (49th)	—	7.4.3.16	2024-02-21	4 versions
CVE-2023-33947US	medium4.3	0.61% (49th)	—	no fix	2023-05-24	≤ 7.4.3.4 ≤7.4.3.60
CVE-2023-33946US	medium4.3	0.61% (49th)	—	no fix	2023-05-24	≤ 7.4.3.4 ≤7.4.3.48
CVE-2024-25146US	medium5.3	0.59% (48th)	—	7.3.6	2024-02-08	6 versions
CVE-2025-4576US	medium6.1	0.59% (48th)	—	7.4.3.132-ga132	2025-08-08	2 versions
CVE-2023-3426US	medium4.3OT elevated	0.58% (47th)	—	no fix	2023-08-02	≤ 7.4.3.81 ≤7.4.3.85
CVE-2023-44310US	medium5.4	0.57% (47th)	—	no fix	2023-10-17	≤ 7.3.6 ≤7.4.3.78
CVE-2023-44309US	medium5.4	0.57% (47th)	—	no fix	2023-10-17	≤ 7.4.2 ≤7.4.3.53
CVE-2024-25144US	medium6.5	0.57% (47th)	—	7.3.7	2024-02-08	7 versions
CVE-2023-44311US	medium6.1	0.57% (47th)	—	no fix	2023-10-17	≤ 7.4.3.41 ≤7.4.3.89
CVE-2023-42497US	medium6.1	0.57% (47th)	—	no fix	2023-10-17	≤ 7.4.3.4 ≤7.4.3.85
CVE-2024-25145US	medium5.4	0.56% (47th)	—	7.3.1	2024-02-07	6 versions
CVE-2024-26266US	medium5.4	0.56% (46th)	—	7.4.3.26	2024-02-21	5 versions
CVE-2024-25603US	medium5.4	0.56% (46th)	—	7.4.3.26	2024-02-21	5 versions
CVE-2024-25601US	medium5.4	0.56% (46th)	—	7.4.3.26	2024-02-21	5 versions
CVE-2024-25152US	medium5.4	0.56% (46th)	—	7.4.3.27	2024-02-21	5 versions
CVE-2024-26269US	medium6.1	0.56% (46th)	—	7.4.3.27	2024-02-21	5 versions
CVE-2024-25147US	medium6.1	0.56% (46th)	—	7.4.2	2024-02-21	3 versions
CVE-2025-62254US	high7.5	0.55% (46th)	—	7.4.3.110	2025-10-23	4 versions
CVE-2023-33945US	high8.1	0.55% (46th)	—	no fix	2023-05-24	≤ 7.3.1 ≤7.4.3.17
CVE-2024-25148US	high8.1	0.55% (46th)	—	7.3.1	2024-02-08	5 versions
CVE-2023-33944US	medium6.1	0.53% (45th)	—	no fix	2023-05-24	≤ 7.3.4 ≤7.4.3.68
CVE-2023-33942US	medium5.4	0.53% (45th)	—	no fix	2023-05-24	≤ 7.4.3.50
CVE-2023-33940US	medium5.4	0.53% (45th)	—	no fix	2023-05-24	≤ 7.4.0 ≤7.4.3.30
CVE-2024-26268US	medium5.3	0.53% (44th)	—	7.4.3.98	2024-02-20	9 versions
CVE-2024-26267US	medium5.3OT elevated	0.53% (44th)	—	7.4.3.13	2024-02-20	9 versions
CVE-2023-33938US	medium6.1	0.52% (44th)	—	no fix	2023-05-24	≤ 7.3.0 ≤7.4.0
CVE-2023-33939US	medium5.4	0.52% (44th)	—	no fix	2023-05-24	≤ 7.1.0 ≤7.4.3.12
CVE-2025-3602US	high7.5	0.52% (44th)	—	7.4.3.5-ga5	2025-06-16	4 versions
CVE-2024-25610US	medium5.4OT elevated	0.52% (44th)	—	7.4.3.26	2024-02-20	5 versions
CVE-2025-43772US	—	0.52% (44th)	—	7.4.3.5.	2025-09-04	2 versions

showing 50 of 210

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')100 CVEs
CWE-352Cross-Site Request Forgery (CSRF)11 CVEs
CWE-863Incorrect Authorization10 CVEs
CWE-639Authorization Bypass Through User-Controlled Key9 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')8 CVEs
CWE-862Missing Authorization8 CVEs
CWE-201Insertion of Sensitive Information Into Sent Data7 CVEs
CWE-400Uncontrolled Resource Consumption7 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)207 CVEs
DECERT-Bund (BSI CSAF)119 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan