Login Request a demo
MA
Product
magento-lts
by OpenMage · last CVE May 15, 2026
9
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 1High 2Medium 6Low 0
Severity
All severities9Critical1High2Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add magento-lts to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42207
6.1
0%
May 15
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
Affected: < 20.18.0
CVE-2026-40098
5.4
0%
Apr 20
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Affected: < 20.17.0
CVE-2026-42458
5.3
0%
May 15
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Affected: < 20.18.0
CVE-2026-25523
5.3
0%
Feb 4
Magento's X-Original-Url header can expose admin url
Affected: < 20.16.1
CVE-2026-25525
4.9
1%
Apr 20
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Affected: < 20.17.0
CVE-2025-64174
4.8
0%
Nov 6
OpenMage is vulnerable to XSS in Admin Notifications
Affected: < 20.16.0
Showing 6