Skip to content
Openmage vulnerabilities
Newest
-
openmage magento-lts
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
CVE-2026-42458
Fix available
5.3 Medium
-
openmage magento-lts
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
CVE-2026-42207
Fix available
6.1 Medium
-
openmage magento-lts
Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
CVE-2026-42155
Fix available
9.3 Critical
-
openmage magento, magento-lts +1 more
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
CVE-2026-40488
Fix available
8.7 High
-
openmage magento, magento-lts +1 more
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
CVE-2026-40098
Fix available
5.3 Medium
-
openmage magento, magento-lts +1 more
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
CVE-2026-25525
Fix available
4.9 Medium
-
openmage magento, magento-lts +1 more
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
CVE-2026-25524
Public exploitFix available
8.1 High
-
openmage magento, magento-lts +1 more
Magento's X-Original-Url header can expose admin url
CVE-2026-25523
Fix available
5.3 Medium
-
openmage magento, magento-lts +1 more
OpenMage is vulnerable to XSS in Admin Notifications
CVE-2025-64174
Fix available
4.6 Medium
-
openmage magento-lts
Magento vulnerable to stored XSS in theme config fields
CVE-2025-27400
Fix available
2.9 Low
-
openmage magento, magento-lts +1 more
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
CVE-2024-41676
Fix available
4.1 Medium
-
openmage magento, magento-lts +1 more
Magento LTS's guest order "protect code" can be brute-forced too easily
CVE-2023-41879
Fix available
7.5 High
-
openmage magento, magento-lts +1 more
OpenMage LTS DataFlow upload remote code execution vulnerability
CVE-2021-41231
Fix available
7.2 High
-
openmage magento, magento-lts +1 more
OpenMage LTS authenticated remote code execution through layout update
CVE-2021-41144
Fix available
8.8 High
-
openmage magento, magento-lts +1 more
OpenMage LTS has DoS vulnerability in MaliciousCode filter
CVE-2023-23617
Fix available
4.9 Medium
-
openmage magento, magento-lts +1 more
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
CVE-2021-41143
Fix available
7.2 High
-
openmage magento, magento-lts +1 more
OpenMage LTS arbitrary command execution in custom layout update through blocks
CVE-2021-39217
Fix available
7.2 High
-
openmage magento, magento-lts +1 more
Magneto-lts vulnerable to Cross-Site Request Forgery
CVE-2021-21395
Fix available
4.2 Medium
-
openmage magento, magento-lts +1 more
Data Flow Sanitation Issue Fix
CVE-2021-32759
Fix available
7.2 High
-
openmage, openmage magento-lts +1 more
Layout XML Arbitrary Code Fix
CVE-2021-32758
Fix available
7.2 High
-
openmage magento, magento-lts +1 more
Backport for CVE-2021-21024 Blind SQLi from Magento 2
CVE-2021-21427
Fix available
9.1 Critical
-
openmage magento, magento-lts +1 more
Fixes a bug in Zend Framework's Stream HTTP Wrapper
CVE-2021-21426
Fix available
9.8 Critical
-
openmage, openmage magento-lts +1 more
CMS Editor code execution
CVE-2020-26295
8.7 High
-
openmage, openmage magento-lts +1 more
Widget instances allows a hacker to inject an executable file on the server on OpenMage
CVE-2020-26285
8.7 High
-
openmage, openmage magento-lts +1 more
Layout XML RCE Vulnerability in OpenMage
CVE-2020-26252
8.7 High
-
openmage magento, magento-lts +1 more
RCE in Magento
CVE-2020-15244
Fix available
8.0 High
-
magento, openmage magento-lts, long term support +2 more
Observable Timing Discrepancy in OpenMage LTS
CVE-2020-15151
Fix available
8.0 High