Log in Start free

OpenMage

Products

ProductCVEsExploitedLatest
magento-lts27–May 15, 2026

Exploited and recent CVEs

  • CVE-2026-42207 Medium 6.1 Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts 0.2%
  • CVE-2026-42155 Critical 9.3 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs 0.4%
  • CVE-2026-42458 Medium 5.3 Magento LTS: Reflected XSS - Import -> Data Flow (profiles) 0.3%
  • CVE-2026-40488 High 8.7 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution 0.7%
  • CVE-2026-40098 Medium 5.3 OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant 0.2%
  • CVE-2026-25525 Medium 4.9 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module 0.5%
  • CVE-2026-25524 High 8.1 OpenMage LTS's Phar Deserialization leads to Remote Code Execution 0.6%
  • CVE-2026-25523 Medium 5.3 Magento's X-Original-Url header can expose admin url 0.3%
  • CVE-2025-64174 Medium 4.6 OpenMage is vulnerable to XSS in Admin Notifications 0.2%
  • CVE-2025-27400 Low 2.9 Magento vulnerable to stored XSS in theme config fields 0.3%
  • CVE-2024-41676 Medium 4.1 Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs 0.4%
  • CVE-2023-41879 High 7.5 Magento LTS's guest order "protect code" can be brute-forced too easily 1.3%
  • CVE-2023-23617 Medium 4.9 OpenMage LTS has DoS vulnerability in MaliciousCode filter 1.0%
  • CVE-2021-41231 High 7.2 OpenMage LTS DataFlow upload remote code execution vulnerability 1.2%
  • CVE-2021-41144 High 8.8 OpenMage LTS authenticated remote code execution through layout update 1.2%
  • CVE-2021-41143 High 7.2 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution 1.3%
  • CVE-2021-39217 High 7.2 OpenMage LTS arbitrary command execution in custom layout update through blocks 1.3%
  • CVE-2021-21395 Medium 4.2 Magneto-lts vulnerable to Cross-Site Request Forgery 0.4%
  • CVE-2021-32759 High 7.2 Data Flow Sanitation Issue Fix 1.8%
  • CVE-2021-32758 High 7.2 Layout XML Arbitrary Code Fix 2.0%
  • CVE-2021-21427 Critical 9.1 Backport for CVE-2021-21024 Blind SQLi from Magento 2 1.1%
  • CVE-2021-21426 Critical 9.8 Fixes a bug in Zend Framework's Stream HTTP Wrapper 1.2%
  • CVE-2020-26295 High 8.7 CMS Editor code execution 2.2%
  • CVE-2020-26285 High 8.7 Widget instances allows a hacker to inject an executable file on the server on OpenMage 3.7%
  • CVE-2020-26252 High 8.7 Layout XML RCE Vulnerability in OpenMage 2.1%
  • CVE-2020-15244 High 8.0 RCE in Magento 1.3%
  • CVE-2020-15151 High 8.0 Observable Timing Discrepancy in OpenMage LTS 0.9%