CB
Product
Commerce B2b
On CISA KEVExploited in the wild
141
CVEs
4
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 9High 57Medium 62Low 13
Watch
Add Commerce B2b to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47996 | 6.8 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21360 | 6.8 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-54267 | 6.5 | Oct 14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-27207 | 6.5 | Jun 10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege… Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; +16 more |
| CVE-2025-24427 | 6.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2025-24426 | 6.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2025-24424 | 6.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2025-24422 | 6.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2025-24408 | 6.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2024-45132 | 6.5 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2024-45118 | 6.5 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-48000 | 6.1 | Jul 14 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2024-45123 | 6.1 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-47997 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-47998 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-54265 | 5.9 | Oct 14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-49558 | 5.9 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21294 | 5.5 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21293 | 5.5 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-48371 | 5.4 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21292 | 5.4 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-24437 | 5.4 | Feb 11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security… Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.4; +8 more |
| CVE-2025-24428 | 5.4 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2024-45131 | 5.4 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2024-45128 | 5.4 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-34654 | 5.3 | May 12 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21310 | 5.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21286 | 5.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21282 | 5.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-49559 | 5.3 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-27206 | 5.3 | Jun 10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; +16 more |
| CVE-2025-27191 | 5.3 | Apr 8 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; +13 more |
| CVE-2025-27190 | 5.3 | Apr 8 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +14 more |
| CVE-2025-24425 | 5.3 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; 1.3.4; +9 more |
| CVE-2024-45124 | 5.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-48411 | 4.9 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +22 more |
| CVE-2024-45119 | 4.9 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file… Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-47999 | 4.8 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-34658 | 4.8 | May 12 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-34655 | 4.8 | May 12 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21291 | 4.8 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-54266 | 4.8 | Oct 14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2024-45127 | 4.8 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin… Affected: 1.3.3; 1.3.3; 1.3.4; 1.3.4; 1.3.5; 1.3.5; +3 more |
| CVE-2026-21359 | 4.7 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-34656 | 4.3 | May 12 | Adobe Commerce | Improper Authorization (CWE-285) Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21297 | 4.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21296 | 4.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2026-21285 | 4.3 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-49550 | 4.3 | Jun 25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; +34 more |
| CVE-2025-27189 | 4.3 | Apr 8 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited… Affected: before 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.3; 1.3.4; +14 more |