Skip to content
Fencer Intel

All · maven

Newest first, late arrivals on top. Also a feed.

  1. 6.1
    CVE-2025-43795 Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect
    maven
  2. 7.5
    CVE-2025-43796 Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
    maven
  3. 5.4
    CVE-2025-43787 Liferay Portal's selection modal is vulnerable to XSS
    maven
  4. 4.3
    CVE-2025-43788 Liferay Portal's Organization Selector exposes organization data to remote authenticated users
    maven
  5. 5.3
    CVE-2025-43789 Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution
    maven
  6. 8.1
    CVE-2025-43790 Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass
    maven
  7. 4.3
    CVE-2025-43782 Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name
    maven
  8. 6.1
    CVE-2025-43783 Liferay Portal is vulnerable to Reflected XSS attack through get_editor path
    maven
  9. 6.5
    CVE-2025-43784 Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data
    maven
  10. 6.1
    CVE-2025-43785 Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting
    maven
  11. 5.3
    CVE-2025-43786 Liferay Portal exposes ERC which can lead to exploit the time response attack
    maven
  12. 6.1
    CVE-2025-43781 Liferay Portal is vulnerable to XSS attack through its search bar portlet
    maven
  13. 5.4
    CVE-2025-43775 Liferay Portal is vulnerable to XSS attacks via its remote app title field
    maven
  14. 5.4
    CVE-2025-43776 Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
    maven
  15. —
    GHSA-qgj5-4qvg-2f8c Liferay Portal is vulnerable to XSS attack through its Style Book theme
    maven
  16. 5.3
    CVE-2025-43777 Liferay Portal exposes 500 status when attempting login with a deleted client secret
    maven
  17. 6.1
    CVE-2025-43778 Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin
    maven
  18. 6.5
    CVE-2025-43763 Liferay Portal is vulnerable to SSRF through custom object attachment fields
    maven
  19. 8.7
    CVE-2025-58365 XWiki Blog Application: Privilege Escalation (PR) from account through blog content
    maven
  20. 6.5
    CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
    maven
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  21. 5.3
    CVE-2025-58369 fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side
    maven
  22. 4.3
    CVE-2025-10044 Keycloak: keycloak error_description injection on error pages
    maven
  23. —
    GHSA-c7v7-rqfm-f44j Vaadin Platform possible file bypass via upload validation on the server-side
    maven
  24. —
    GHSA-94g8-xv23-7656 Vaadin Flow Components possible file bypass via upload validation on the server-side
    maven
  25. 5.3
    CVE-2025-9467 Possibility to bypass file upload validation on the server-side
    maven
  26. 7.1
    CVE-2025-43772 Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin
    maven
  27. 7.5
    CVE-2025-58056 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
    maven
  28. 7.5
    CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
    maven
  29. 7.5
    CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints
    maven
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  30. 9.1
    CVE-2025-55747 XWiki Platform's configuration files can be accessed through the webjars API
    maven
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%