Adobe Commerce B2B vulnerabilities | LiveThreat CVE Feed

Product

Adobe Commerce B2B

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities56 In the news11 Timeline

Severity mix

Critical 11High 31Medium 12Low 2

Severity

All severities56 Critical11 High31 Medium12 Low2

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Adobe Commerce B2B to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-75650 In wildKEV	10.0	4%	Sep 7	Adobe Commerce \| Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) Affected: through 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
CVE-2026-48356 In wildKEV	9.3	31%	Jul 14	Adobe Commerce \| Unrestricted Upload of File with Dangerous Type (CWE-434) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
CVE-2026-71362 In wildKEV	9.1	90%	Aug 11	Adobe Commerce \| Incorrect Authorization (CWE-863) Affected: through 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
CVE-2026-103849	10.0	1%	Oct 13	Adobe Commerce \| Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
CVE-2026-92909	9.8	1%	Oct 13	Adobe Commerce \| Incorrect Authorization (CWE-863) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
CVE-2026-91013	9.3	1%	Oct 13	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
CVE-2026-100133	9.3	1%	Oct 13	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
CVE-2026-76200	9.3	1%	Sep 8	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
CVE-2026-76201	9.3	1%	Sep 8	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
CVE-2026-92464	9.1	1%	Oct 13	Adobe Commerce \| Improper Input Validation (CWE-20) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep
CVE-2026-48358	9.1	1%	Jul 14	Adobe Commerce \| Improper Encoding or Escaping of Output (CWE-116) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18