Medium
CVE-2026-42458
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filters
Medium
CVE-2026-42207
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Critical
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
High
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Medium
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Medium
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
High
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Medium
CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Medium
CVE-2025-64174
OpenMage vulnerable to XSS in Admin Notifications
Low
CVE-2025-27400
Magento LTS vulnerable to stored XSS in theme config fields
Medium
CVE-2024-41676
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Medium
ghsa-gp6m-fq6h-cjcx
Magento LTS vulnerable to stored XSS in admin file form
High
ghsa-9j5w-2cqc-cwj9
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
High
CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
High
CVE-2021-41231
DataFlow upload remote code execution vulnerability
High
CVE-2021-41144
Fix for authenticated remote code execution through layout update
Medium
CVE-2023-23617
DoS vulnerability in MaliciousCode filter
High
CVE-2021-41143
Fix for arbitrary file deletion in customer media allows for remote code execution
High
CVE-2021-39217
Fix for arbitrary command execution in custom layout update through blocks
Medium
CVE-2021-21395
magento-lts Reset Password not protected against well-timed CSRF
High
CVE-2021-32758
Layout XML Arbitrary Code Fix
High
CVE-2021-32759
Data Flow Sanitation Issue Fix
Critical
CVE-2021-21427
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Critical
CVE-2021-21426
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.