Liferay Security AdvisoriesLiferay Security Advisorieshttps://uat.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/rss2026-10-15T07:52:12Z2026-10-15T07:52:12ZCVE-TEST-TESTBen Turnerhttps://uat.liferay.dev/w/cve-test-test?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2026-05-13T05:50:31Z2026-05-13T05:44:00ZBen Turner2026-05-13T05:44:00ZCVE-2025-43825 Sensible user data available to freemarker templateAlex Candidohttps://uat.liferay.dev/w/cve-2025-43825?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-10-03T21:12:50Z2025-10-03T09:08:00ZAlex Candido2025-10-03T09:08:00ZCVE-2025-43816 Memory leak when consuming the headless API for StructuredContentsAlex Candidohttps://uat.liferay.dev/w/cve-2025-43816?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-25T20:04:12Z2025-09-25T08:04:00ZAlex Candido2025-09-25T08:04:00ZCVE-2025-43819 User session is not killed by SLO APIAlex Candidohttps://uat.liferay.dev/w/cve-2025-43819?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-24T01:32:16Z2025-09-23T13:32:00ZAlex Candido2025-09-23T13:32:00ZCVE-2025-43814 Password reminder answers recorded in audit eventsAlex Candidohttps://uat.liferay.dev/w/cve-2025-43814?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-22T22:57:13Z2025-09-22T10:57:00ZAlex Candido2025-09-22T10:57:00ZCVE-2025-43806 Unauthorized access to exported data from batch engineAlex Candidohttps://uat.liferay.dev/w/cve-2025-43806?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-22T21:36:22Z2025-09-22T09:36:00ZAlex Candido2025-09-22T09:36:00ZCVE-2025-43809 CSRF vulnerability with server (license) registrationAlex Candidohttps://uat.liferay.dev/w/cve-2025-43809?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-19T19:23:41Z2025-09-19T07:23:00ZAlex Candido2025-09-19T07:23:00ZCVE-2025-43801 DoS via unchecked input for loop condition in XML-RPCAlex Candidohttps://uat.liferay.dev/w/cve-2025-43801?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-16T16:09:23Z2025-09-16T16:09:00ZAlex Candido2025-09-16T16:09:00ZCVE-2025-43804 Reflected XSS in Search widgetAlex Candidohttps://uat.liferay.dev/w/cve-2025-43804?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-16T22:26:01Z2025-09-16T10:26:00ZAlex Candido2025-09-16T10:26:00ZCVE-2025-43805 Display Page Templates visible to unauthorized usersAlex Candidohttps://uat.liferay.dev/w/cve-2025-43805?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-16T21:31:14Z2025-09-16T09:31:00ZAlex Candido2025-09-16T09:31:00ZCVE-2025-43791 XSS with Rich Text fields in Data EngineAlex Candidohttps://uat.liferay.dev/w/cve-2025-43791?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T18:04:23Z2025-09-15T18:04:00ZAlex Candido2025-09-15T18:04:00ZCVE-2025-43792 Staging site data exfiltrationAlex Candidohttps://uat.liferay.dev/w/cve-2025-43792?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T16:21:54Z2025-09-15T16:21:00ZAlex Candido2025-09-15T16:21:00ZCVE-2025-43793 SupercookieAlex Candidohttps://uat.liferay.dev/w/cve-2025-43793?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T15:33:19Z2025-09-15T15:33:00ZAlex Candido2025-09-15T15:33:00ZCVE-2025-43794 XSS with CDN host nameAlex Candidohttps://uat.liferay.dev/w/cve-2025-43794?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T11:09:11Z2025-09-15T11:09:00ZAlex Candido2025-09-15T11:09:00ZCVE-2025-43797 Insecure default site membership typeAlex Candidohttps://uat.liferay.dev/w/cve-2025-43797?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T21:25:22Z2025-09-15T09:25:00ZAlex Candido2025-09-15T09:25:00ZCVE-2025-43798 Time-based One-Time Password (TOTP) reuseAlex Candidohttps://uat.liferay.dev/w/cve-2025-43798?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T20:48:24Z2025-09-15T08:48:00ZAlex Candido2025-09-15T08:48:00ZCVE-2025-43800 XSS with rich text type fields in objectsAlex Candidohttps://uat.liferay.dev/w/cve-2025-43800?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-15T19:04:43Z2025-09-15T07:04:00ZAlex Candido2025-09-15T07:04:00ZCVE-2025-43787 Stored XSS via organization site namesAlex Candidohttps://uat.liferay.dev/w/cve-2025-43787?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-16T19:44:25Z2025-09-12T16:04:00ZAlex Candido2025-09-12T16:04:00ZCVE-2025-43796 GraphQL does not limit page sizeAlex Candidohttps://uat.liferay.dev/w/cve-2025-43796?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-12T19:13:58Z2025-09-12T07:13:00ZAlex Candido2025-09-12T07:13:00ZCVE-2025-43784 Illegal access to Object Entries information from the API BuilderAlex Candidohttps://uat.liferay.dev/w/cve-2025-43784?redirect=%2Fportal%2Fsecurity%2Fknown-vulnerabilities%2F-%2Fasset_publisher%2Fjekt%2Frss2025-09-10T18:50:49Z2025-09-10T18:50:00ZAlex Candido2025-09-10T18:50:00Z