Skip to contentOpenmage Magento-lts vulnerabilities
- openmage magento-ltsMagento LTS: Reflected XSS - Import -> Data Flow (profiles)CVE-2026-42458Fix available5.3 Medium
- openmage magento-ltsMagento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-ltsCVE-2026-42207Fix available6.1 Medium
- openmage magento-ltsMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsCVE-2026-42155Fix available9.3 Critical
- openmage magento, magento-lts +1 moreOpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code ExecutionCVE-2026-40488Fix available8.7 High
- openmage magento, magento-lts +1 moreOpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variantCVE-2026-40098Fix available5.3 Medium
- openmage magento, magento-lts +1 moreOpenMage LTS has Path Traversal Filter Bypass in Dataflow ModuleCVE-2026-25525Fix available4.9 Medium
- openmage magento, magento-lts +1 moreOpenMage LTS's Phar Deserialization leads to Remote Code ExecutionCVE-2026-25524Public exploitFix available8.1 High
- openmage magento, magento-lts +1 moreMagento's X-Original-Url header can expose admin urlCVE-2026-25523Fix available5.3 Medium
- openmage magento, magento-lts +1 moreOpenMage is vulnerable to XSS in Admin NotificationsCVE-2025-64174Fix available4.6 Medium
- openmage magento-ltsMagento vulnerable to stored XSS in theme config fieldsCVE-2025-27400Fix available2.9 Low
- openmage magento, magento-lts +1 moreMagento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configsCVE-2024-41676Fix available4.1 Medium
- openmage magento, magento-lts +1 moreMagento LTS's guest order "protect code" can be brute-forced too easilyCVE-2023-41879Fix available7.5 High
- openmage magento, magento-lts +1 moreOpenMage LTS DataFlow upload remote code execution vulnerabilityCVE-2021-41231Fix available7.2 High
- openmage magento, magento-lts +1 moreOpenMage LTS authenticated remote code execution through layout updateCVE-2021-41144Fix available8.8 High
- openmage magento, magento-lts +1 moreOpenMage LTS has DoS vulnerability in MaliciousCode filterCVE-2023-23617Fix available4.9 Medium
- openmage magento, magento-lts +1 moreOpenMage LTS arbitrary file deletion in customer media allows for remote code executionCVE-2021-41143Fix available7.2 High
- openmage magento, magento-lts +1 moreOpenMage LTS arbitrary command execution in custom layout update through blocksCVE-2021-39217Fix available7.2 High
- openmage magento, magento-lts +1 moreMagneto-lts vulnerable to Cross-Site Request ForgeryCVE-2021-21395Fix available4.2 Medium
- openmage magento, magento-lts +1 moreData Flow Sanitation Issue FixCVE-2021-32759Fix available7.2 High
- openmage, openmage magento-lts +1 moreLayout XML Arbitrary Code FixCVE-2021-32758Fix available7.2 High
- openmage magento, magento-lts +1 moreBackport for CVE-2021-21024 Blind SQLi from Magento 2CVE-2021-21427Fix available9.1 Critical
- openmage magento, magento-lts +1 moreFixes a bug in Zend Framework's Stream HTTP WrapperCVE-2021-21426Fix available9.8 Critical
- openmage, openmage magento-lts +1 moreCMS Editor code executionCVE-2020-262958.7 High
- openmage, openmage magento-lts +1 moreWidget instances allows a hacker to inject an executable file on the server on OpenMageCVE-2020-262858.7 High
- openmage, openmage magento-lts +1 moreLayout XML RCE Vulnerability in OpenMageCVE-2020-262528.7 High
- openmage magento, magento-lts +1 moreRCE in MagentoCVE-2020-15244Fix available8.0 High
- magento, openmage magento-lts, long term support +2 moreObservable Timing Discrepancy in OpenMage LTSCVE-2020-15151Fix available8.0 High