Openmage Magento vulnerabilities

• openmage magento-lts Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVE-2026-42458 Fix available 5.3 MediumMay 6, 2026
• openmage magento-lts Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts CVE-2026-42207 Fix available 6.1 MediumMay 5, 2026
• openmage magento-lts Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs CVE-2026-42155 Fix available 9.3 CriticalMay 5, 2026
• openmage magento, magento-lts +1 more OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVE-2026-40488 Fix available 8.7 HighApril 20, 2026
• openmage magento, magento-lts +1 more OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant CVE-2026-40098 Fix available 5.3 MediumApril 20, 2026
• openmage magento, magento-lts +1 more OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVE-2026-25525 Fix available 4.9 MediumApril 20, 2026
• openmage magento, magento-lts +1 more OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVE-2026-25524 Public exploitFix available 8.1 HighApril 20, 2026
• openmage magento, magento-lts +1 more Magento's X-Original-Url header can expose admin url CVE-2026-25523 Fix available 5.3 MediumFebruary 2, 2026
• openmage magento, magento-lts +1 more OpenMage is vulnerable to XSS in Admin Notifications CVE-2025-64174 Fix available 4.6 MediumNovember 3, 2025
• openmage magento-lts Magento vulnerable to stored XSS in theme config fields CVE-2025-27400 Fix available 2.9 LowFebruary 28, 2025
• openmage magento, magento-lts +1 more Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs CVE-2024-41676 Fix available 4.1 MediumJuly 29, 2024
• openmage magento, magento-lts +1 more Magento LTS's guest order "protect code" can be brute-forced too easily CVE-2023-41879 Fix available 7.5 HighSeptember 11, 2023
• openmage magento, magento-lts +1 more OpenMage LTS DataFlow upload remote code execution vulnerability CVE-2021-41231 Fix available 7.2 HighJanuary 27, 2023
• openmage magento, magento-lts +1 more OpenMage LTS authenticated remote code execution through layout update CVE-2021-41144 Fix available 8.8 HighJanuary 27, 2023
• openmage magento, magento-lts +1 more OpenMage LTS has DoS vulnerability in MaliciousCode filter CVE-2023-23617 Fix available 4.9 MediumJanuary 27, 2023
• openmage magento, magento-lts +1 more OpenMage LTS arbitrary file deletion in customer media allows for remote code execution CVE-2021-41143 Fix available 7.2 HighJanuary 27, 2023
• openmage magento, magento-lts +1 more OpenMage LTS arbitrary command execution in custom layout update through blocks CVE-2021-39217 Fix available 7.2 HighJanuary 27, 2023
• openmage magento, magento-lts +1 more Magneto-lts vulnerable to Cross-Site Request Forgery CVE-2021-21395 Fix available 4.2 MediumJanuary 26, 2023
• openmage magento, magento-lts +1 more Data Flow Sanitation Issue Fix CVE-2021-32759 Fix available 7.2 HighAugust 27, 2021
• openmage, openmage magento-lts +1 more Layout XML Arbitrary Code Fix CVE-2021-32758 Fix available 7.2 HighAugust 27, 2021
• openmage magento, magento-lts +1 more Backport for CVE-2021-21024 Blind SQLi from Magento 2 CVE-2021-21427 Fix available 9.1 CriticalApril 21, 2021
• openmage magento, magento-lts +1 more Fixes a bug in Zend Framework's Stream HTTP Wrapper CVE-2021-21426 Fix available 9.8 CriticalApril 21, 2021
• openmage, openmage magento-lts +1 more CMS Editor code execution CVE-2020-26295 8.7 HighJanuary 21, 2021
• openmage, openmage magento-lts +1 more Widget instances allows a hacker to inject an executable file on the server on OpenMage CVE-2020-26285 8.7 HighJanuary 21, 2021
• openmage, openmage magento-lts +1 more Layout XML RCE Vulnerability in OpenMage CVE-2020-26252 8.7 HighJanuary 20, 2021
• openmage magento, magento-lts +1 more RCE in Magento CVE-2020-15244 Fix available 8.0 HighOctober 21, 2020
• magento, openmage magento-lts, long term support +2 more Observable Timing Discrepancy in OpenMage LTS CVE-2020-15151 Fix available 8.0 HighAugust 19, 2020