OP
Vendor
Openmage
32
CVEs
0
On KEV
0
New 30D
Products
MA9.8
Magento
Openmage
18 CVEs0 on KEV0 new
MA9.3
magento-lts
OpenMage
9 CVEs0 on KEV0 new
OP7.2
Openmage
Openmage
4 CVEs0 on KEV0 new
OL8.0
Openmage Long Term Support
Openmage
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42207 | MA magento-lts OpenMage | 6.1 | May 15 | Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts |
| CVE-2026-42155 | MA magento-lts OpenMage | 9.3 | May 15 | Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs |
| CVE-2026-42458 | MA magento-lts OpenMage | 5.3 | May 15 | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) |
| CVE-2026-40488 | MA magento-lts OpenMage | 8.8 | Apr 20 | OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution |
| CVE-2026-40098 | MA magento-lts OpenMage | 5.4 | Apr 20 | OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant |
| CVE-2026-25525 | MA magento-lts OpenMage | 4.9 | Apr 20 | OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module |
| CVE-2026-25524 | MA magento-lts OpenMage | 8.1 | Apr 20 | OpenMage LTS's Phar Deserialization leads to Remote Code Execution |
| CVE-2026-25523 | MA magento-lts OpenMage | 5.3 | Feb 4 | Magento's X-Original-Url header can expose admin url |
| CVE-2025-64174 | MA magento-lts OpenMage | 4.8 | Nov 6 | OpenMage is vulnerable to XSS in Admin Notifications |
| CVE-2024-41676 | MA Magento Openmage | 4.8 | Jul 29 | Magento-lts is a long-term support alternative to Magento Community Edition (CE) |
| CVE-2023-41879 | MA Magento Openmage | 7.5 | Sep 11 | Magento LTS is the official OpenMage LTS codebase |
| CVE-2023-23617 | MA Magento Openmage | 7.5 | Jan 28 | OpenMage LTS is an e-commerce platform |
| CVE-2021-41231 | MA Magento Openmage | 7.2 | Jan 27 | OpenMage LTS is an e-commerce platform |
| CVE-2021-41144 | MA Magento Openmage | 8.8 | Jan 27 | OpenMage LTS is an e-commerce platform |
| CVE-2021-41143 | MA Magento Openmage | 7.2 | Jan 27 | OpenMage LTS is an e-commerce platform |
| CVE-2021-39217 | MA Magento Openmage | 7.2 | Jan 27 | OpenMage LTS is an e-commerce platform |
| CVE-2021-21395 | MA Magento Openmage | 4.3 | Jan 27 | Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases |
| CVE-2021-32759 | MA Magento Openmage | 7.2 | Aug 27 | OpenMage magento-lts is an alternative to the Magento CE official releases |
| CVE-2021-32758 | OP Openmage Openmage | 7.2 | Aug 27 | OpenMage Magento LTS is an alternative to the Magento CE official releases |
| CVE-2021-21427 | MA Magento Openmage | 7.2 | Apr 21 | Magento-lts is a long-term support alternative to Magento Community Edition (CE) |
| CVE-2021-21426 | MA Magento Openmage | 9.8 | Apr 21 | Magento-lts is a long-term support alternative to Magento Community Edition (CE) |
| CVE-2020-26295 | OP Openmage Openmage | 7.2 | Jan 21 | OpenMage is a community-driven alternative to Magento CE |
| CVE-2020-26285 | OP Openmage Openmage | 7.2 | Jan 21 | OpenMage is a community-driven alternative to Magento CE |
| CVE-2020-26252 | OP Openmage Openmage | 7.2 | Jan 20 | OpenMage is a community-driven alternative to Magento CE |
| CVE-2020-15244 | MA Magento Openmage | 7.2 | Oct 21 | In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object… |
| CVE-2020-15151 | OL Openmage Long Term Support Openmage | 8.0 | Aug 20 | OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site… |