Magento
OpenMage · 18 CVEs
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Apr 20, 2026
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-d…
Apr 20, 2026
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Apr 20, 2026
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Apr 20, 2026
Magento's X-Original-Url header can expose admin url
Feb 4, 2026
OpenMage is vulnerable to XSS in Admin Notifications
Nov 6, 2025
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Jul 29, 2024
Magento LTS's guest order "protect code" can be brute-forced too easily
Sep 11, 2023
OpenMage LTS has DoS vulnerability in MaliciousCode filter
Jan 27, 2023
OpenMage LTS DataFlow upload remote code execution vulnerability
Jan 27, 2023
OpenMage LTS authenticated remote code execution through layout update
Jan 27, 2023
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
Jan 27, 2023
OpenMage LTS arbitrary command execution in custom layout update through blocks
Jan 27, 2023
Magneto-lts vulnerable to Cross-Site Request Forgery
Jan 27, 2023
Data Flow Sanitation Issue Fix
Aug 27, 2021
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Apr 21, 2021
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Apr 21, 2021
RCE in Magento
Oct 21, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-40488 | OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution | HIGH | 0.96% | Apr 20, 2026 |
| CVE-2026-40098 | OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant | MEDIUM | 0.25% | Apr 20, 2026 |
| CVE-2026-25525 | OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module | MEDIUM | 0.65% | Apr 20, 2026 |
| CVE-2026-25524 | OpenMage LTS's Phar Deserialization leads to Remote Code Execution | HIGH | 0.71% | Apr 20, 2026 |
| CVE-2026-25523 | Magento's X-Original-Url header can expose admin url | MEDIUM | 0.43% | Feb 4, 2026 |
| CVE-2025-64174 | OpenMage is vulnerable to XSS in Admin Notifications | MEDIUM | 0.22% | Nov 6, 2025 |
| CVE-2024-41676 | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs | MEDIUM | 0.36% | Jul 29, 2024 |
| CVE-2023-41879 | Magento LTS's guest order "protect code" can be brute-forced too easily | HIGH | 1.25% | Sep 11, 2023 |
| CVE-2023-23617 | OpenMage LTS has DoS vulnerability in MaliciousCode filter | HIGH | 0.99% | Jan 27, 2023 |
| CVE-2021-41231 | OpenMage LTS DataFlow upload remote code execution vulnerability | HIGH | 1.23% | Jan 27, 2023 |
| CVE-2021-41144 | OpenMage LTS authenticated remote code execution through layout update | HIGH | 1.17% | Jan 27, 2023 |
| CVE-2021-41143 | OpenMage LTS arbitrary file deletion in customer media allows for remote code execution | HIGH | 1.29% | Jan 27, 2023 |
| CVE-2021-39217 | OpenMage LTS arbitrary command execution in custom layout update through blocks | HIGH | 1.32% | Jan 27, 2023 |
| CVE-2021-21395 | Magneto-lts vulnerable to Cross-Site Request Forgery | MEDIUM | 0.38% | Jan 27, 2023 |
| CVE-2021-32759 | Data Flow Sanitation Issue Fix | HIGH | 1.34% | Aug 27, 2021 |
| CVE-2021-21427 | Backport for CVE-2021-21024 Blind SQLi from Magento 2 | CRITICAL | 1.07% | Apr 21, 2021 |
| CVE-2021-21426 | Fixes a bug in Zend Framework's Stream HTTP Wrapper | CRITICAL | 1.20% | Apr 21, 2021 |
| CVE-2020-15244 | RCE in Magento | HIGH | 1.26% | Oct 21, 2020 |
Showing 1 to 18 of 18 CVEs