Adobe Adobe Commerce B2B
75 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-95631 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | HIGH 8.7 | 0.9 % | ||
| CVE-2026-103849 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | CRITICAL 10.0 | 1.2 % | ||
| CVE-2026-92910 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.2 | 0.4 % | ||
| CVE-2026-92464 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 0.9 % | ||
| CVE-2026-91013 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.9 % | ||
| CVE-2026-95630 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-92922 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.9 % | ||
| CVE-2026-92909 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-92908 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.3 | 0.6 % | ||
| CVE-2026-100133 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 1.0 % | ||
| CVE-2026-92911 | ≤ 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.9 % | ||
| CVE-2026-76201 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-76200 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-77109 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.7 % | ||
| CVE-2026-77110 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 7.6 | 1.1 % | ||
| CVE-2026-77108 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76202 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.7 % | ||
| CVE-2026-77774 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-77111 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.7 | 0.8 % | ||
| CVE-2026-75650 | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | CRITICAL 10.0 | 3.9 % | KEV | |
| CVE-2026-48416 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-48414 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.3 % | ||
| CVE-2026-48413 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2026-48415 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.3 | 0.6 % | ||
| CVE-2026-48412 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.2 | 0.6 % | ||
| CVE-2026-48411 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-71362 | ≤ 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | Adobe Commerce | Incorrect Authorization (CWE-863) | CRITICAL 9.1 | 90 % | KEV | |
| CVE-2026-47984 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.7 % | ||
| CVE-2026-47997 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-47988 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-47999 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.4 % | ||
| CVE-2026-48358 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) | CRITICAL 9.1 | 1.2 % | ||
| CVE-2026-48356 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 9.3 | 31 % | KEV | |
| CVE-2026-47998 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-48000 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-48001 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Information Exposure (CWE-200) | LOW 3.7 | 0.5 % | ||
| CVE-2026-47995 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.7 % | ||
| CVE-2026-48371 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-47996 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.8 | 0.9 % | ||
| CVE-2026-47994 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2026-47992 | ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | HIGH 7.2 | 1.0 % | ||
| CVE-2026-34656 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-34658 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-34650 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 15 % | ||
| CVE-2026-34686 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.4 % | ||
| CVE-2026-34647 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.4 | 0.7 % | ||
| CVE-2026-34685 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Improper Input Validation (CWE-20) | LOW 3.4 | 0.4 % | ||
| CVE-2026-34653 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.7 | 0.6 % | ||
| CVE-2026-34652 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | HIGH 7.5 | 0.5 % | ||
| CVE-2026-34645 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-34648 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 21 % | ||
| CVE-2026-34649 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 14 % | ||
| CVE-2026-34655 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.4 % | ||
| CVE-2026-34654 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-34651 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 0.7 % | ||
| CVE-2026-34646 | ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-21293 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-21291 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-21282 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-21286 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-21294 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-21284 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.4 % | ||
| CVE-2026-21297 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-21359 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-21309 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-21292 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-21310 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-21285 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-21290 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-21289 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-21361 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.5 % | ||
| CVE-2026-21360 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.8 | 0.6 % | ||
| CVE-2026-21296 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-21311 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.0 | 0.3 % | ||
| CVE-2026-21295 | ≤ 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | LOW 3.1 | 0.2 % |