CO
E-commerce
Commerce
On CISA KEVExploited in the wild
251
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 23High 104Medium 110Low 14
Watch
Add Commerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-22249 | 4.8 | Mar 27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5 |
| CVE-2022-34258 | 4.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2026-21359 | 4.7 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2026-95630 | 4.3 | Oct 13 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
| CVE-2026-34656 | 4.3 | May 12 | Adobe Commerce | Improper Authorization (CWE-285) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-21297 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2026-21285 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2026-21296 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2025-49550 | 4.3 | Jun 25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-27188 | 4.3 | Apr 8 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2025-24436 | 4.3 | Feb 11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +31 more |
| CVE-2025-24435 | 4.3 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +31 more |
| CVE-2025-24421 | 4.3 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2024-45130 | 4.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-45129 | 4.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-45125 | 4.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-45122 | 4.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2024-45121 | 4.3 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2024-39419 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39417 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39416 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39415 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39414 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39413 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39412 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39411 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39410 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39409 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39408 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass… Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39407 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39405 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2024-39404 | 4.3 | Aug 14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass Affected: through 2.4.3; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +25 more |
| CVE-2023-29296 | 4.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +2 more |
| CVE-2023-29295 | 4.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2023-29294 | 4.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2023-29288 | 4.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +2 more |
| CVE-2023-22251 | 4.3 | Mar 27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5 |
| CVE-2026-48001 | 3.7 | Jul 14 | Adobe Commerce | Information Exposure (CWE-200) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2025-24432 | 3.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24430 | 3.7 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2025-24429 | 3.5 | Feb 11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +32 more |
| CVE-2026-34685 | 3.4 | May 12 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14 |
| CVE-2026-21295 | 3.1 | Mar 11 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2024-45120 | 3.1 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2025-49549 | 2.7 | Jun 25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security… Affected: before 2.4.5; 2.4.5; 2.4.5; 2.4.5; 2.4.5; 2.4.5; +26 more |
| CVE-2025-27192 | 2.7 | Apr 8 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to… Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +34 more |
| CVE-2024-45149 | 2.7 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +28 more |
| CVE-2024-45135 | 2.7 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-45134 | 2.7 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |
| CVE-2024-45133 | 2.7 | Oct 10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more |