CO
E-commerce
Commerce
On CISA KEVExploited in the wild
251
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 23High 104Medium 110Low 14
Watch
Add Commerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-34103 | 8.1 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +18 more |
| CVE-2024-20759 | 8.1 | Apr 10 | Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +18 more |
| CVE-2021-21013 | 8.1 | Jan 13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module Affected: through 2.4.1; 2.4.1 and later |
| CVE-2020-8818 | 8.1 | Feb 25 | An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2 Affected: 2.3.4 |
| CVE-2026-21311 | 8.0 | Mar 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2024-49521 | 7.7 | Nov 12 | Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass Affected: before 3.2.6 |
| CVE-2024-39399 | 7.7 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2026-77110 | 7.6 | Sep 8 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
| CVE-2024-45117 | 7.6 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system… Affected: 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2024-39403 | 7.6 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2026-77108 | 7.5 | Sep 8 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug |
| CVE-2026-48416 | 7.5 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| CVE-2026-34650 | 7.5 | May 12 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34652 | 7.5 | May 12 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14 |
| CVE-2026-34645 | 7.5 | May 12 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34648 | 7.5 | May 12 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34649 | 7.5 | May 12 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34651 | 7.5 | May 12 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-34646 | 7.5 | May 12 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-21309 | 7.5 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2026-21289 | 7.5 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2025-49556 | 7.5 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-49554 | 7.5 | Aug 12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to… Affected: before 2.4.5; 2.4.5; 2.4.5; 2.4.5; 2.4.5; 2.4.5; +34 more |
| CVE-2025-24406 | 7.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2023-38220 | 7.5 | Oct 13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2023-38207 | 7.5 | Aug 9 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +6 more |
| CVE-2023-22248 | 7.5 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2023-22247 | 7.5 | Mar 27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5 |
| CVE-2021-36044 | 7.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36030 | 7.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2026-34647 | 7.4 | May 12 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2024-39398 | 7.4 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2026-92910 | 7.2 | Oct 13 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
| CVE-2026-48412 | 7.2 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug |
| CVE-2026-47992 | 7.2 | Jul 14 | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 |
| CVE-2024-34110 | 7.2 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-34109 | 7.2 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-34108 | 7.2 | Jun 13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2022-24093 | 7.2 | Sep 12 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability Affected: before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.4.3; 2.4.3 |
| CVE-2023-38208 | 7.2 | Aug 9 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +6 more |
| CVE-2023-29297 | 7.2 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2022-34253 | 7.2 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-36042 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36041 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36040 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36035 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36034 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36033 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36031 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]`… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36029 | 7.2 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |