What’s Vulnerable › Products
OpenMage magento-lts vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your OpenMage magento-lts version is affected
Latest OpenMage magento-lts vulnerabilities
- CVE-2026-42458 — Magento LTS: Reflected XSS - Import -> Data Flow (profiles) (CVSS 5.3)
- CVE-2026-42207 — Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts (CVSS 6.1)
- CVE-2026-42155 — Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs (CVSS 9.3)
- CVE-2026-40488 — OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution (CVSS 8.8)
- CVE-2026-40098 — OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant (CVSS 5.4)
- CVE-2026-25525 — OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module (CVSS 4.9)
- CVE-2026-25524 — OpenMage LTS's Phar Deserialization leads to Remote Code Execution (CVSS 8.1)
- CVE-2026-25523 — Magento's X-Original-Url header can expose admin url (CVSS 5.3)
- CVE-2025-64174 — OpenMage is vulnerable to XSS in Admin Notifications (CVSS 4.8)
- CVE-2025-27400 — Magento vulnerable to stored XSS in theme config fields (CVSS 2.9)
- CVE-2024-41676 — Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs (CVSS 4.8)
- CVE-2023-41879 — Magento LTS's guest order "protect code" can be brute-forced too easily (CVSS 7.5)
- CVE-2023-23617 — OpenMage LTS has DoS vulnerability in MaliciousCode filter (CVSS 7.5)
- CVE-2021-41231 — OpenMage LTS DataFlow upload remote code execution vulnerability (CVSS 7.2)
- CVE-2021-41144 — OpenMage LTS authenticated remote code execution through layout update (CVSS 8.8)
- CVE-2021-41143 — OpenMage LTS arbitrary file deletion in customer media allows for remote code execution (CVSS 7.2)
- CVE-2021-39217 — OpenMage LTS arbitrary command execution in custom layout update through blocks (CVSS 7.2)
- CVE-2021-21395 — Magneto-lts vulnerable to Cross-Site Request Forgery (CVSS 4.3)
- CVE-2021-32759 — Data Flow Sanitation Issue Fix (CVSS 6.5)
- CVE-2021-21427 — Backport for CVE-2021-21024 Blind SQLi from Magento 2 (CVSS 7.2)
- CVE-2021-21426 — Fixes a bug in Zend Framework's Stream HTTP Wrapper (CVSS 9.8)
- CVE-2020-15244 — RCE in Magento (CVSS 7.2)