OpenMage vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20217
3. 20237
4. 20241
5. 20252
6. 20268

Newest CVEs

• CVE-2026-42207

  Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts

  OpenMage · magento-lts

  Medium6.1
• CVE-2026-42155

  Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

  OpenMage · magento-lts

  Critical9.3
• CVE-2026-42458

  Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

  OpenMage · magento-lts

  Medium5.3
• CVE-2026-40488

  OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

  OpenMage · magento-lts

  High8.7
• CVE-2026-40098

  OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant

  OpenMage · magento-lts

  Medium5.3
• CVE-2026-25525

  OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module

  OpenMage · magento-lts

  Medium4.9
• CVE-2026-25524

  OpenMage LTS's Phar Deserialization leads to Remote Code Execution

  OpenMage · magento-lts

  High8.1
• CVE-2026-25523

  Magento's X-Original-Url header can expose admin url

  OpenMage · magento-lts

  Medium5.3
• CVE-2025-64174

  OpenMage is vulnerable to XSS in Admin Notifications

  OpenMage · magento-lts

  Medium4.6
• CVE-2025-27400

  Magento vulnerable to stored XSS in theme config fields

  OpenMage · magento-lts

  Low2.9