Login Request a demo
CO
E-commerce
Commerce
by Adobe · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
251
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Vulnerabilities251In the news12Timeline
Severity mix
Critical 23High 104Medium 110Low 14
Severity
All severities251Critical23High104Medium110Low14
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Commerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-75650
In wildKEV
10.0
4%
Sep 7
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2024-34102
In wildKEV
9.8
100%
Jun 13
XXE can expose crypt key and other secrets granting full admin access
Affected: through 2.4.4-p8
CVE-2022-24086
In wildKEV
9.8
99%
Feb 16
Adobe Commerce checkout improper input validation leads to remote code execution
Affected: before 2.3.0; 2.3.3 through 2.3.6; 2.4.0 through 2.4.2; 2.3.7; 2.3.7; 2.4.3; +1 more
CVE-2026-48356
In wildKEV
9.3
31%
Jul 14
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2026-71362
In wildKEV
9.1
90%
Aug 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
CVE-2025-54236
In wildKEV
9.1
95%
Sep 9
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.4-p15
CVE-2026-103849
10.0
1%
Oct 13
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-92909
9.8
1%
Oct 13
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
CVE-2024-45115
9.8
1%
Oct 10
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation
Affected: 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more
CVE-2024-34107
9.8
1%
Jun 13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2022-34256
9.8
2%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2021-36020
9.8
3%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2026-91013
9.3
1%
Oct 13
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
CVE-2026-100133
9.3
1%
Oct 13
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-76200
9.3
1%
Sep 8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-76201
9.3
1%
Sep 8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-92464
9.1
1%
Oct 13
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-48358
9.1
1%
Jul 14
Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2025-24434
9.1
17%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +31 more
CVE-2024-20720
9.1
4%
Feb 15
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +11 more
CVE-2024-20719
9.1
1%
Feb 15
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +11 more
CVE-2024-39397
9.0
1%
Aug 14
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…
Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more
CVE-2024-20758
9.0
1%
Apr 10
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +18 more
CVE-2024-45148
8.8
1%
Oct 10
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2024-34111
8.8
1%
Jun 13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2023-38218
8.8
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more
CVE-2022-42344
8.8
1%
Oct 20
[CVE-2021-36032] Magento IDOR Leads to Account Takeover
Affected: through 2.4.3-p2
CVE-2022-34255
8.8
2%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2022-34254
8.8
2%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2021-36032
8.8
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2026-95631
8.7
1%
Oct 13
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-92911
8.7
1%
Oct 13
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-77111
8.7
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-48414
8.7
0%
Aug 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-48413
8.7
1%
Aug 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-47994
8.7
1%
Jul 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2026-34686
8.7
0%
May 12
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-34653
8.7
1%
May 12
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-21290
8.7
0%
Mar 11
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more
CVE-2025-49557
8.7
1%
Aug 12
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more
CVE-2025-24438
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +31 more
CVE-2025-24417
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24416
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24415
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24414
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24413
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24412
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2025-24410
8.7
1%
Feb 11
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more
CVE-2023-38219
8.7
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS)…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2026-77109
8.6
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
Page 1 of 6 · 251 total
12…6