Login Request a demo
MA
Product
Magento
by Openmage · last CVE Apr 20, 2026
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 11Medium 6Low 0
Severity
All severities18Critical1High11Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Magento to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40098
5.4
0%
Apr 20
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Affected: before 20.17.0
CVE-2026-25523
5.3
0%
Feb 4
Magento's X-Original-Url header can expose admin url
Affected: through 20.16.0
CVE-2026-25525
4.9
1%
Apr 20
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Affected: before 20.17.0
CVE-2025-64174
4.8
0%
Nov 6
OpenMage is vulnerable to XSS in Admin Notifications
Affected: before 20.16.0
CVE-2024-41676
4.8
0%
Jul 29
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
Affected: before 20.10.1
CVE-2021-21395
4.3
0%
Jan 27
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases
Affected: before 19.4.22; 20.0.0 before 20.0.19
Showing 6