CO
E-commerce
Commerce
On CISA KEVExploited in the wild
251
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 23High 104Medium 110Low 14
Watch
Add Commerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45148 | 8.8 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-34111 | 8.8 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2023-38218 | 8.8 | Oct 13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more |
| CVE-2022-42344 | 8.8 | Oct 20 | [CVE-2021-36032] Magento IDOR Leads to Account Takeover Affected: through 2.4.3-p2 |
| CVE-2022-34255 | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2022-34254 | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-36032 | 8.8 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2026-95631 | 8.7 | Oct 13 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
| CVE-2026-92911 | 8.7 | Oct 13 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
| CVE-2026-77111 | 8.7 | Sep 8 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| CVE-2026-48414 | 8.7 | Aug 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| CVE-2026-48413 | 8.7 | Aug 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| CVE-2026-47994 | 8.7 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2026-34686 | 8.7 | May 12 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34653 | 8.7 | May 12 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-21290 | 8.7 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-49557 | 8.7 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-24438 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +31 more |
| CVE-2025-24417 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24416 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24415 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24414 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24413 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24412 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24410 | 8.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2023-38219 | 8.7 | Oct 13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS)… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2026-77109 | 8.6 | Sep 8 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
| CVE-2026-77774 | 8.6 | Sep 8 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
| CVE-2026-47988 | 8.6 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 |
| CVE-2025-47110 | 8.4 | Jun 10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2024-39402 | 8.4 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39401 | 8.4 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2026-92908 | 8.3 | Oct 13 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
| CVE-2026-48415 | 8.3 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul |
| CVE-2026-76202 | 8.2 | Sep 8 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
| CVE-2026-47984 | 8.2 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2025-43585 | 8.2 | Jun 10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-24409 | 8.2 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2024-34104 | 8.2 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2026-92922 | 8.1 | Oct 13 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep |
| CVE-2026-47995 | 8.1 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2026-21361 | 8.1 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2026-21284 | 8.1 | Mar 11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-54264 | 8.1 | Oct 14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting… Affected: 2.4.6; 2.4.6; 2.4.6; 2.4.6; 2.4.6; 2.4.6; +25 more |
| CVE-2025-54263 | 8.1 | Oct 14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-49555 | 8.1 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-43586 | 8.1 | Jun 10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-24411 | 8.1 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2024-45116 | 8.1 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary… Affected: 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2024-39400 | 8.1 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |