Feed live

Magento vulnerabilities - every known CVE across Magento and Adobe Commerce

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Magento and Adobe Commerce run large-scale retail deployments, so CVEs here are tracked with particular attention to PCI-relevant checkout and admin-panel flaws.

Total CVEs tracked

347,749

All time

Critical · Active

12,050

CVSS ≥ 9.0

New · 14 days

2,437

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-36039	medium	6.5/10	Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure	Sep 1, 2021 4y ago
CVE-2021-36029	critical	9.1/10	Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36026	medium	6.5/10	Magento Commerce Stored Cross-site Scripting Vulnerability	Sep 1, 2021 4y ago
CVE-2021-36032	high	8.3/10	Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation	Sep 1, 2021 4y ago
CVE-2021-36038	medium	6.5/10	Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure	Sep 1, 2021 4y ago
CVE-2021-36028	critical	9.1/10	Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36034	critical	9.1/10	Magento Commerce Improper Input Validation Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36022	critical	9.1/10	Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36033	critical	9.1/10	Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution	Sep 1, 2021 4y ago
CVE-2021-36037	medium	6.5/10	Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure	Sep 1, 2021 4y ago
CVE-2021-36012	medium	6.5/10	Magento Commerce Gift Card Business Logic Error	Sep 1, 2021 4y ago
CVE-2021-28584	medium	5.4/10	Magento Commerce path traversal vulnerability in child theme store creation	Jun 28, 2021 5y ago
CVE-2021-28585	medium	5.3/10	Magento Commerce improper input validation in customer customer webapi	Jun 28, 2021 5y ago
CVE-2021-28583	high	7.5/10	Magento Commerce insecure storage of sensitive documentation	Jun 28, 2021 5y ago
CVE-2021-28563	medium	6.5/10	Magento Commerce improper Authorization via the 'Create Customer' endpoint	Jun 28, 2021 5y ago
CVE-2021-28556	medium	6.9/10	Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution	Jun 28, 2021 5y ago
CVE-2021-32684	medium	6.2/10	Missing Handler in @scandipwa/magento-scripts	Jun 14, 2021 5y ago
CVE-2021-21427	critical	9.1/10	Backport for CVE-2021-21024 Blind SQLi from Magento 2	Apr 21, 2021 5y ago
CVE-2021-21064	medium	4.9/10	Magento UPWARD-php Path traversal vulnerability via UPWARD Connector	Feb 25, 2021 5y ago
CVE-2021-21014	critical	9.1/10	Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution	Feb 11, 2021 5y ago
CVE-2021-21016	critical	9.1/10	Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution	Feb 11, 2021 5y ago
CVE-2021-21032	medium	5.6/10	Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access	Feb 11, 2021 5y ago
CVE-2021-21029	medium	4.8/10	Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution	Feb 11, 2021 5y ago
CVE-2021-21025	critical	9.1/10	Magento Commerce XML Injection Could Lead To Arbitrary Code Execution	Feb 11, 2021 5y ago
CVE-2021-21030	high	8.1/10	Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution	Feb 11, 2021 5y ago
CVE-2021-21027	medium	4.3/10	Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification	Feb 11, 2021 5y ago
CVE-2021-21026	medium	5.3/10	Magento Commerce Incorrect permissions Could Lead To Unauthorized Access	Feb 11, 2021 5y ago
CVE-2021-21024	critical	9.1/10	Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access	Feb 11, 2021 5y ago
CVE-2021-21023	medium	4.8/10	Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution	Feb 11, 2021 5y ago
CVE-2021-21022	medium	5.3/10	Magento Commerce Incorrect permissions Could Lead To Unauthorized Access	Feb 11, 2021 5y ago