In Liferay Portal versions 7.4.3.50 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 Update 50 through Update 92 a medium severity vulnerability CVE-2025-43811 was detected. This stored cross-site scripting vulnerability in the related asset selector allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload placed in an asset author’s First Name, Middle Name, or Last Name fields. To address this issue, users should upgrade Liferay Portal to version7.4.3.112 and Liferay DXP to versions 2024.Q1.1, 2023.Q4.5, 2023.Q3.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43811.
Read more CMS
In Liferay Portal versions 7.4.3.4 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through Update 92 a medium severity vulnerability CVE-2025-43812 was detected. This cross-site scripting vulnerability in web content templates allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload placed in a web content structure’s Name field. To address this issue, users should upgrade Liferay Portal to version 7.4.3.112 and Liferay DXP to versions 2024.Q1.1, 2023.Q4.5, 2023.Q3.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43812.
Read more CMS
In Argo CD versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6, and 3.0.17 a high severity vulnerability CVE-2025-59538 was detected. This vulnerability allows unauthenticated attackers to cause a denial-of-service (DoS) by sending a malformed Azure DevOps git.push webhook to the /api/webhook endpoint when webhook.azuredevops.username and webhook.azuredevops.password are not set, causing the server process to crash due to an index-out-of-range panic on an empty JSON array. To address this issue, users should upgrade Argo CD to versions 2.14.20, 3.2.0-rc2, 3.1.8 or 3.0.19. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59538.
Read more Developer Tools
In Argo CD versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 a high severity vulnerability CVE-2025-59537 was detected. This vulnerability allows unauthenticated attackers to cause a denial-of-service (DoS) condition by sending a malformed Gogs webhook payload to the `/api/webhook` endpoint when `webhook.gogs.secret` is not set, causing the Argo CD server process to crash if the `commits[].repo` field in the JSON payload is missing or null. To address this issue, users should upgrade Argo CD to versions 2.14.20, 3.2.0-rc2, 3.1.8 or 3.0.19. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59537.
Read more Developer Tools
In Argo CD versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 a high severity vulnerability CVE-2025-59531 was detected. This vulnerability allows unauthenticated attackers to cause a denial-of-service (DoS) condition by sending a malformed Bitbucket Server webhook payload to the `/api/webhook` endpoint when `webhook.bitbucketserver.secret` is not configured, causing the Argo CD server process to crash and potentially triggering a full API outage. To address this issue, users should upgrade Argo CD to versions 2.14.20, 3.2.0-rc2, 3.1.8 or 3.0.19. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59531.
Read more Developer Tools
In Liferay Portal versions 7.4.3.35 through 7.4.3.110 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 Update 35 through Update 92, and 7.3 Update 25 through Update 36 a medium severity vulnerability CVE-2025-43820 was detected. This issue affects the Calendar widget, where crafted payloads injected into a user’s First Name, Middle Name, or Last Name fields can allow attackers to insert arbitrary script or HTML when users are invited to an event. To address this vulnerability, users should upgrade Liferay Portal to versions 7.4.3.111 and Liferay DXP to versions 2024.Q1.1, 2023.Q4.5, 2023.Q3.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43820.
Read more CMS
In Liferay Portal versions 7.4.3.74 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 Update 74 through Update 92 a medium severity vulnerability CVE-2025-43817 was detected. This issue consists of multiple reflected script injection vulnerabilities, where remote attackers can inject arbitrary script or HTML through the redirect parameter in Announcements or Alerts. To address this vulnerability, users should upgrade Liferay Portal to version 7.4.3.112 and Liferay DXP to versions 2023.Q3.9, 2023.Q4.7, 2024.Q1.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43817.
Read more CMS
In Liferay Portal versions 7.4.0 through 7.4.3.107, 7.3.0 through 7.3.7, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through Update 92, 7.3 GA through Update 35, and older unsupported releases a medium severity vulnerability CVE-2025-43813 was detected. This path traversal and denial-of-service issue in the ComboServlet allows remote attackers to access arbitrary CSS and JavaScript files and to repeatedly load them via crafted query strings, potentially causing resource exhaustion. To address this vulnerability, users should upgrade Liferay Portal to versions 7.4.3.108 and Liferay DXP to versions 2024.Q1.1, 2023.Q4.5, 2023.Q3.9, 7.3 U36 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43813.
Read more CMS
In Liferay Portal versions 7.2.0 through 7.4.3.112 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4, and older unsupported versions a medium severity vulnerability CVE-2025-43814 was detected. This issue occurs because audit events record a user’s password reminder answer, which can allow remote authenticated users to obtain this sensitive information through the audit logs. To address this vulnerability, users should upgrade Liferay Portal to version 7.4.3.113 and Liferay DXP to versions 2024.Q2.0, 2024.Q1.1, 2023.Q4.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43814.
Read more CMS