Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-53787	critical	9.3/10	Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload	Jun 12, 2026 14d ago
CVE-2026-45247	critical	9.3/10	Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection	May 26, 2026 1mo ago
CVE-2026-42207	medium	6.1/10	Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts	May 15, 2026 1mo ago
CVE-2026-42155	critical	9.3/10	Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs	May 15, 2026 1mo ago
CVE-2026-42458	medium	5.3/10	Magento LTS: Reflected XSS - Import -> Data Flow (profiles)	May 15, 2026 1mo ago
CVE-2026-5603	medium	4.8/10	elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection	Apr 5, 2026 2mo ago
CVE-2026-25523	medium	5.3/10	Magento's X-Original-Url header can expose admin url	Feb 4, 2026 4mo ago
CVE-2025-58669	medium	5.9/10	WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability	Sep 22, 2025 9mo ago
CVE-2024-41676	medium	4.1/10	Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs	Jul 29, 2024 1y ago
CVE-2023-34379	medium	5.4/10	WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2023-38220	high	7.5/10	Full page cache enumeration via cookie X-Magento-Vary	Oct 13, 2023 2y ago
CVE-2023-41879	high	7.5/10	Magento LTS's guest order "protect code" can be brute-forced too easily	Sep 11, 2023 2y ago
CVE-2021-36036	high	7.2/10	Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution	Sep 6, 2023 2y ago
CVE-2021-36021	high	7.2/10	Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution	Sep 6, 2023 2y ago
CVE-2021-36023	critical	9.1/10	Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution	Sep 6, 2023 2y ago
CVE-2022-42344	high	8.8/10	[CVE-2021-36032] Magento IDOR Leads to Account Takeover	Oct 20, 2022 3y ago
CVE-2021-28567	medium	5.0/10	Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission	Sep 8, 2021 4y ago
CVE-2021-28566	low	3.7/10	Magento Commerce information disclosure during upload action leveraging a specially crafted file	Sep 8, 2021 4y ago
CVE-2021-36044	high	7.5/10	Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service	Sep 1, 2021 4y ago
CVE-2021-36027	medium	6.5/10	Magento Commerce Stored Cross-site Scripting Vulnerability	Sep 1, 2021 4y ago
CVE-2021-36043	high	8.0/10	Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36042	critical	9.1/10	Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36030	high	7.5/10	Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation	Sep 1, 2021 4y ago
CVE-2021-36041	critical	9.1/10	Magento Commerce Improper Input Validation Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36040	critical	9.1/10	Magento Commerce Improper Input Validation Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36025	critical	9.1/10	Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36020	high	8.2/10	Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36035	critical	9.1/10	Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36024	critical	9.1/10	Magento Commerce Improper Neutralization of Special Elements Used In A Command	Sep 1, 2021 4y ago
CVE-2021-36031	high	7.2/10	Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution	Sep 1, 2021 4y ago