Technology · Maven

com.liferay.portal:release.dxp.bom (Maven) vulnerabilities

Updated 27 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 34 vulnerabilities in com.liferay.portal:release.dxp.bom (Maven): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2024-11993, was published on 17 December 2024.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

Latest com.liferay.portal:release.dxp.bom (Maven) vulnerabilities

CVE-2024-11993: Liferay Portal and Liferay DXP vulnerable to Cross-site ScriptinglowCVSS 3.1EPSS 0.3%17 Dec 2024
CVE-2021-29050: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use PagelowCVSS 3.1EPSS 0.3%21 Feb 2024
CVE-2024-25605: Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or APIlowCVSS 3.1EPSS 0.5%20 Feb 2024
CVE-2024-25149: Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site OptionslowCVSS 3.1EPSS 0.3%20 Feb 2024
CVE-2023-47798: Liferay Portal's account lockout does not invalidate existing user sessionslowCVSS 3.1EPSS 0.3%8 Feb 2024
CVE-2023-44311: Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect ClasslowCVSS 3.1EPSS 0.5%17 Oct 2023
CVE-2023-42497: Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation PagelowCVSS 3.1EPSS 0.5%17 Oct 2023
CVE-2023-42629: Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary PagelowCVSS 3.1EPSS 2.2%17 Oct 2023
CVE-2023-44309: Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment ComponentslowCVSS 3.1EPSS 0.5%17 Oct 2023
CVE-2023-3426: Liferay Portal and Liferay DXP Organization Selector Does Not Check User PermissionslowCVSS 3.1EPSS 0.6%2 Aug 2023
CVE-2023-35030: Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout ModulelowCVSS 3.1EPSS 0.4%15 Jun 2023
CVE-2023-35029: Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout ModulelowCVSS 3.1EPSS 0.5%15 Jun 2023
CVE-2023-3193: Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout ModulelowCVSS 3.1EPSS 0.4%15 Jun 2023
CVE-2022-42119: Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce ModulelowCVSS 3.1EPSS 0.4%15 Nov 2022
CVE-2022-42122: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL ModulelowCVSS 3.1EPSS 0.8%15 Nov 2022
CVE-2022-42114: Liferay Portal and Liferay DXP Vulnerable to XSS via the Role ModulelowCVSS 3.1EPSS 0.5%19 Oct 2022
CVE-2022-42113: Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library ModulelowCVSS 3.1EPSS 0.5%19 Oct 2022
CVE-2022-28980: Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ PrefixlowCVSS 3.1EPSS 0.4%23 Sep 2022
CVE-2022-38512: Liferay Portal and Liferay DXP Fails to Check Permissions in Translation ModulelowCVSS 3.1EPSS 0.7%23 Sep 2022
CVE-2021-33339: Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site ScriptinglowCVSS 3.1EPSS 0.7%24 May 2022
CVE-2021-29046: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module ParameterlowCVSS 3.1EPSS 0.9%24 May 2022
CVE-2021-29045: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin PagelowCVSS 3.1EPSS 0.8%24 May 2022
CVE-2021-29053: Liferay Portal and Liferay DXP Vulnerable to Multiple SQL InjectionslowCVSS 3.1EPSS 1.2%24 May 2022
CVE-2021-29052: Liferay Portal and Liferay DXP Fails to Check PermissionslowCVSS 3.1EPSS 0.8%24 May 2022
CVE-2021-29041: Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication ModulelowCVSS 3.1EPSS 1.1%24 May 2022

Most severe com.liferay.portal:release.dxp.bom (Maven) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2023-42629: Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary PagelowCVSS 3.1EPSS 2.2%17 Oct 2023
CVE-2021-38266: Liferay Portal and Liferay DXP fails to properly import users from LDAPlowCVSS 3.1EPSS 1.7%4 Mar 2022
CVE-2021-29053: Liferay Portal and Liferay DXP Vulnerable to Multiple SQL InjectionslowCVSS 3.1EPSS 1.2%24 May 2022
CVE-2021-29041: Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication ModulelowCVSS 3.1EPSS 1.1%24 May 2022
CVE-2021-29047: Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After UselowCVSS 3.1EPSS 1.1%24 May 2022
CVE-2021-29046: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module ParameterlowCVSS 3.1EPSS 0.9%24 May 2022
CVE-2021-38263: Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script consolelowCVSS 3.1EPSS 0.9%4 Mar 2022
CVE-2021-29045: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin PagelowCVSS 3.1EPSS 0.8%24 May 2022
CVE-2022-42122: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL ModulelowCVSS 3.1EPSS 0.8%15 Nov 2022
CVE-2021-29052: Liferay Portal and Liferay DXP Fails to Check PermissionslowCVSS 3.1EPSS 0.8%24 May 2022

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
29 Jun 2026		0	0
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "com.liferay.portal:release.dxp.bom (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom, 27 September 2026.