How many CVEs have a located fix in liferay/liferay-portal?

159 published CVEs have a fix traced to functions in liferay/liferay-portal, touching 353 functions across 330 files.

Which function in liferay/liferay-portal has been patched by the most CVEs?

escapeRedirect in portal-impl/src/com/liferay/portal/util/PortalImpl.java has been changed by 4 CVE fixes, from 2022 to 2025.

How large is a typical CVE fix in liferay/liferay-portal?

The median fix changes 9 lines. 61% of fixes change 20 lines or fewer, and 38% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

jsp

#14 of 500 repositories

liferay/liferay-portal

Name: liferay/liferay-portal: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix November 1, 2025

159

CVE fixes located

Published CVEs

353

Functions patched

Distinct function sites

330

Files patched

Distinct source files

2011–2025

Years covered

By CVE publication date

Overview

159 published CVEs have a fix traced to functions in liferay/liferay-portal, the earliest published in 2011. Those fixes changed 353 distinct functions across 330 files, in 953 patch hunks.

Among the 500 repositories tracked here, liferay/liferay-portal ranks #14 by the number of CVEs with a located fix.

Most patched functions

Functions in liferay/liferay-portal changed by the most CVE fixes.

Most patched files

Files in liferay/liferay-portal changed by the most CVE fixes.

1portal-impl/src/com/liferay/portal/service/impl/UserLocalServiceImpl.java4 CVEs · 6 functions
2portal-impl/src/com/liferay/portal/util/PortalImpl.java4 CVEs · 3 functions
3modules/apps/dynamic-data-mapping/dynamic-data-mapping-form-web/src/main/java/com/liferay/dynamic/data/mapping/form/web/internal/portlet/action/UploadFileEntryMVCActionCommand.java3 CVEs · 4 functions
4modules/apps/dynamic-data-mapping/dynamic-data-mapping-web/src/main/java/com/liferay/dynamic/data/mapping/web/internal/portlet/action/RenderStructureFieldMVCResourceCommand.java3 CVEs · 3 functions
5modules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java3 CVEs · 1 functions
6portal-impl/src/com/liferay/portal/util/PropsValues.java3 CVEs · 1 functions
7modules/apps/portal-workflow/portal-workflow-kaleo-runtime-integration-impl/src/main/java/com/liferay/portal/workflow/kaleo/runtime/integration/internal/WorkflowDefinitionManagerImpl.java2 CVEs · 16 functions
8modules/apps/portal-workflow/portal-workflow-api/src/main/java/com/liferay/portal/workflow/util/WorkflowDefinitionManagerUtil.java2 CVEs · 10 functions
9modules/apps/portal-workflow/portal-workflow-api/src/main/java/com/liferay/portal/workflow/manager/WorkflowDefinitionManager.java2 CVEs · 6 functions
10modules/apps/commerce/commerce-service/src/main/java/com/liferay/commerce/internal/security/permission/resource/CommerceOrderModelResourcePermissionLogic.java2 CVEs · 4 functions

Fix size

How much code a CVE fix in liferay/liferay-portal changes, with backports counted once.

9

Median lines changed

Added plus removed, per CVE

61%

Fixes of 20 lines or fewer

Share of CVE fixes

38%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in liferay/liferay-portal, and the functions each fix changed.

Liferay Portal and DXP do not check permissions of images in a blog entry
CVE-2025-62275showDragAndDropZone
Medium · CVSS 6.9
EPSS 0.3%2025-11-01
Liferay Portal and DXP use an incorrect cache-control header
CVE-2025-62276doGet
Medium · CVSS 4.6
EPSS 0.1%2025-10-31
Liferay Portal vulnerable to password enumeration
CVE-2025-62257
Medium · CVSS 6.3
EPSS 0.4%2025-10-29
Liferay Portal Stores Password Reset Tokens in Plain Text
CVE-2025-62261notifyUser
Medium · CVSS 6.9
EPSS 0.3%2025-10-27
Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature
CVE-2025-62262_updateUser
Medium · CVSS 4.6
EPSS 0.1%2025-10-27
Liferay Portal Vulnerable to Cross-Site Scripting
CVE-2025-62263
Medium · CVSS 4.8
EPSS 0.2%2025-10-27
Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
CVE-2025-62253doProcessAction
Medium · CVSS 6.9
EPSS 0.2%2025-10-27
Liferay Portal ComboServlet denial of service via large file combination
CVE-2025-62254doService PropsValues PropsKeys
Medium · CVSS 6.9
EPSS 0.6%2025-10-23
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
CVE-2025-62255attachListener EditKBArticle
Low · CVSS 2.0
EPSS 0.2%2025-10-23
Liferay Portal and DXP do not properly restrict access to OpenAPI
CVE-2025-62256_buildDefaultFilterProperties RESTClientHttpRequest _toDictionary
Medium · CVSS 6.9
EPSS 0.4%2025-10-23
Liferay Portal and DXP are Missing Authorization in Collection Provider
CVE-2025-62247getCompanyId
Low · CVSS 2.0
EPSS 0.3%2025-10-22
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
CVE-2025-62248doServeResource
Medium · CVSS 4.8
EPSS 0.2%2025-10-22

Get an alert for each new liferay/liferay-portal CVE, with the patched functions and AI-written analysis.

Monitor liferay-portal CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

discourse/discourse159 CVEs go-gitea/gitea162 CVEs jenkinsci/jenkins167 CVEs WWBN/AVideo146 CVEs django/django144 CVEs FreeRDP/FreeRDP144 CVEs misp/misp142 CVEs mattermost/mattermost141 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in liferay/liferay-portal.

How many CVEs have a located fix in liferay/liferay-portal?: 159 published CVEs have a fix traced to functions in liferay/liferay-portal, touching 353 functions across 330 files.
Which function in liferay/liferay-portal has been patched by the most CVEs?: escapeRedirect in portal-impl/src/com/liferay/portal/util/PortalImpl.java has been changed by 4 CVE fixes, from 2022 to 2025.
How large is a typical CVE fix in liferay/liferay-portal?: The median fix changes 9 lines. 61% of fixes change 20 lines or fewer, and 38% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track liferay/liferay-portal CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing