Adobe Magento Commerce vulnerabilities

CVEs per yearBy the year they were published

1. 20209
2. 202149
3. 202211
4. 202316

Known exploitedNewest addition to KEV first

• CVE-2022-24086

  Adobe Commerce checkout improper input validation leads to remote code execution

  Adobe · Magento Commerce

  ExploitedCritical9.8

Newest CVEs

• CVE-2023-38208

  Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

  Adobe · Magento Commerce

  Critical9.1
• CVE-2023-38209

  Adobe Commerce Incorrect Authorization Security feature bypass

  Adobe · Magento Commerce

  Medium6.5
• CVE-2023-29297

  Admin-to-admin stored XSS via cache poisoning

  Adobe · Magento Commerce

  Critical9.1
• CVE-2023-29296

  [Cloud] Customer suspects IDOR vulnerability

  Adobe · Magento Commerce

  Medium4.3
• CVE-2023-29295

  Insecure Direct Object Reference (IDOR) in Create Quote Function

  Adobe · Magento Commerce

  Medium4.3
• CVE-2023-29294

  Bypass Purchase Order Approval using Company User in Adobe Commerce B2B

  Adobe · Magento Commerce

  Medium4.3
• CVE-2023-29292

  Server Side Request Forgery (SSRF) in FedEx carrier integration configuration

  Adobe · Magento Commerce

  Medium4.9
• CVE-2023-29291

  Server Side Request Forgery (SSRF) in USPS carrier integration configuration

  Adobe · Magento Commerce

  Medium4.9
• CVE-2023-29290

  Adobe Commerce Guest Cart Shipping Address Overwrite IDOR

  Adobe · Magento Commerce

  Medium5.3
• CVE-2023-29289

  Adobe Commerce XML Injection Security feature bypass

  Adobe · Magento Commerce

  Medium6.5