Login Request a demo
MA
Product
Magento
by Openmage · last CVE Apr 20, 2026
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 11Medium 6Low 0
Severity
All severities18Critical1High11Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Magento to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-21426
9.8
1%
Apr 21
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
Affected: before 19.4.13; 20.0.0 before 20.0.9
CVE-2026-40488
8.8
1%
Apr 20
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Affected: before 20.17.0
CVE-2021-41144
8.8
1%
Jan 27
OpenMage LTS is an e-commerce platform
Affected: before 19.4.22; 20.0.0 before 20.0.19
CVE-2026-25524
8.1
1%
Apr 20
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Affected: before 20.17.0
CVE-2023-41879
7.5
1%
Sep 11
Magento LTS is the official OpenMage LTS codebase
Affected: before 19.5.1; 20.0.0 before 20.1.1
CVE-2023-23617
7.5
1%
Jan 28
OpenMage LTS is an e-commerce platform
Affected: before 19.4.22; 20.0.0 before 20.0.19
CVE-2021-41231
7.2
1%
Jan 27
OpenMage LTS is an e-commerce platform
Affected: before 19.4.22; 20.0.0 before 20.0.19
CVE-2021-41143
7.2
1%
Jan 27
OpenMage LTS is an e-commerce platform
Affected: before 19.4.22; 20.0.0 before 20.0.19
CVE-2021-39217
7.2
1%
Jan 27
OpenMage LTS is an e-commerce platform
Affected: before 19.4.22; 20.0.0 before 20.0.19
CVE-2021-32759
7.2
1%
Aug 27
OpenMage magento-lts is an alternative to the Magento CE official releases
Affected: before 19.4.13; 20.0.0 before 20.0.11
CVE-2021-21427
7.2
1%
Apr 21
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
Affected: before 19.4.13; 20.0.0 before 20.0.9
CVE-2020-15244
7.2
1%
Oct 21
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object…
Affected: through 19.4.8; 20.0.0 before 20.0.4
CVE-2026-40098
5.4
0%
Apr 20
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Affected: before 20.17.0
CVE-2026-25523
5.3
0%
Feb 4
Magento's X-Original-Url header can expose admin url
Affected: through 20.16.0
CVE-2026-25525
4.9
1%
Apr 20
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Affected: before 20.17.0
CVE-2025-64174
4.8
0%
Nov 6
OpenMage is vulnerable to XSS in Admin Notifications
Affected: before 20.16.0
CVE-2024-41676
4.8
0%
Jul 29
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
Affected: before 20.10.1
CVE-2021-21395
4.3
0%
Jan 27
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases
Affected: before 19.4.22; 20.0.0 before 20.0.19
Showing 18