Adobe Adobe Commerce
210 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-95631 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | HIGH 8.7 | 0.9 % | ||
| CVE-2026-103849 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | CRITICAL 10.0 | 1.2 % | ||
| CVE-2026-92910 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.2 | 0.4 % | ||
| CVE-2026-92464 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 0.9 % | ||
| CVE-2026-91013 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.9 % | ||
| CVE-2026-95630 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2026-92922 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.9 % | ||
| CVE-2026-92909 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-92908 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.3 | 0.6 % | ||
| CVE-2026-100133 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 1.0 % | ||
| CVE-2026-92911 | ≤ 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.9 % | ||
| CVE-2026-76201 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-76200 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-77109 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.7 % | ||
| CVE-2026-77110 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 7.6 | 1.1 % | ||
| CVE-2026-77108 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76202 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.7 % | ||
| CVE-2026-77774 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-77111 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.7 | 0.8 % | ||
| CVE-2026-75650 | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | CRITICAL 10.0 | 3.9 % | KEV | |
| CVE-2026-48416 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-48414 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.3 % | ||
| CVE-2026-48413 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2026-48415 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.3 | 0.6 % | ||
| CVE-2026-48412 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.2 | 0.6 % | ||
| CVE-2026-48411 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-71362 | ≤ 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | Adobe Commerce | Incorrect Authorization (CWE-863) | CRITICAL 9.1 | 90 % | KEV | |
| CVE-2026-47984 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.7 % | ||
| CVE-2026-47997 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-47988 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-47999 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.4 % | ||
| CVE-2026-48358 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) | CRITICAL 9.1 | 1.2 % | ||
| CVE-2026-48356 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 9.3 | 31 % | KEV | |
| CVE-2026-47998 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-48000 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-48001 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Information Exposure (CWE-200) | LOW 3.7 | 0.5 % | ||
| CVE-2026-47995 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.7 % | ||
| CVE-2026-48371 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.4 % | ||
| CVE-2026-47996 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.8 | 0.9 % | ||
| CVE-2026-47994 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2026-47992 | ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | HIGH 7.2 | 1.0 % | ||
| CVE-2026-34656 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-34658 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-34650 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 15 % | ||
| CVE-2026-34686 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.4 % | ||
| CVE-2026-34647 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.4 | 0.7 % | ||
| CVE-2026-34685 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Improper Input Validation (CWE-20) | LOW 3.4 | 0.4 % | ||
| CVE-2026-34653 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.7 | 0.6 % | ||
| CVE-2026-34652 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | HIGH 7.5 | 0.5 % | ||
| CVE-2026-34645 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-34648 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 21 % | ||
| CVE-2026-34649 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 14 % | ||
| CVE-2026-34655 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.4 % | ||
| CVE-2026-34654 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-34651 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 0.7 % | ||
| CVE-2026-34646 | ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-21293 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-21291 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-21282 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-21286 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-21294 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-21284 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.4 % | ||
| CVE-2026-21297 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-21359 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-21309 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-21292 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-21310 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Improper Input Validation (CWE-20) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-21285 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-21290 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.5 % | ||
| CVE-2026-21289 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-21361 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.5 % | ||
| CVE-2026-21360 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.8 | 0.6 % | ||
| CVE-2026-21296 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-21311 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.0 | 0.3 % | ||
| CVE-2026-21295 | ≤ 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) | LOW 3.1 | 0.2 % | ||
| CVE-2025-54267 | ≤ 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-54266 | ≤ 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-54263 | ≤ 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.1 | 0.6 % | ||
| CVE-2025-54265 | ≤ 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-54264 | ≤ 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 0.6 % | ||
| CVE-2025-54236 | ≤ 2.4.4-p15 | Adobe Commerce | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 95 % | KEV | |
| CVE-2025-49556 | ≤ 2.4.4-p14 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.6 % | ||
| CVE-2025-49557 | ≤ 2.4.4-p14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.6 % | ||
| CVE-2025-49558 | ≤ 2.4.4-p14 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-49554 | ≤ 2.4.4-p14 | Adobe Commerce | Improper Input Validation (CWE-20) | HIGH 7.5 | 0.6 % | ||
| CVE-2025-49559 | ≤ 2.4.4-p14 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-49555 | ≤ 2.4.4-p14 | Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | HIGH 8.1 | 0.9 % | ||
| CVE-2025-49550 | ≤ 2.4.4-p13 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-49549 | ≤ 2.4.4-p13 | Adobe Commerce | Incorrect Authorization (CWE-863) | LOW 2.7 | 0.4 % | ||
| CVE-2025-27206 | ≤ 2.4.4-p13 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-43586 | ≤ 2.4.4-p13 | Adobe Commerce | Improper Access Control (CWE-284) | HIGH 8.1 | 0.6 % | ||
| CVE-2025-47110 | ≤ 2.4.4-p13 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.4 | 0.7 % | ||
| CVE-2025-43585 | ≤ 2.4.4-p13 | Adobe Commerce | Improper Authorization (CWE-285) | HIGH 8.2 | 0.5 % | ||
| CVE-2025-27207 | ≤ 2.4.4-p13 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-27190 | ≤ 2.4.8-beta2 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-27191 | ≤ 2.4.8-beta2 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-27192 | ≤ 2.4.8-beta2 | Adobe Commerce | Insufficiently Protected Credentials (CWE-522) | LOW 2.7 | 0.5 % | ||
| CVE-2025-27189 | ≤ 2.4.8-beta2 | Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | MEDIUM 4.3 | 1.0 % | ||
| CVE-2025-27188 | ≤ 2.4.8-beta2 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.6 % | ||
| CVE-2025-24422 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-24414 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24437 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.4 | 0.4 % | ||
| CVE-2025-24434 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | CRITICAL 9.1 | 17 % | ||
| CVE-2025-24415 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24411 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | HIGH 8.1 | 0.9 % | ||
| CVE-2025-24420 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.6 % | ||
| CVE-2025-24416 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24413 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24419 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.6 % | ||
| CVE-2025-24432 | ≤ 2.4.8-beta1 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | LOW 3.7 | 0.4 % | ||
| CVE-2025-24430 | ≤ 2.4.8-beta1 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | LOW 3.7 | 0.4 % | ||
| CVE-2025-24424 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-24429 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | LOW 3.5 | 0.5 % | ||
| CVE-2025-24436 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-24407 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 7.1 | 0.8 % | ||
| CVE-2025-24438 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.8 % | ||
| CVE-2025-24423 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-24418 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Authorization (CWE-285) | HIGH 8.1 | 1.0 % | ||
| CVE-2025-24406 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 7.5 | 1.4 % | ||
| CVE-2025-24417 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24409 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.7 % | ||
| CVE-2025-24425 | ≤ 2.4.8-beta1 | Adobe Commerce | Business Logic Errors (CWE-840) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2025-24421 | ≤ 2.4.8-beta1 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-24412 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24427 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-24426 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.8 % | ||
| CVE-2025-24428 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.4 % | ||
| CVE-2025-24410 | ≤ 2.4.8-beta1 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.7 | 0.7 % | ||
| CVE-2025-24408 | ≤ 2.4.8-beta1 | Adobe Commerce | Information Exposure (CWE-200) | MEDIUM 6.5 | 1.0 % | ||
| CVE-2025-24435 | ≤ 2.4.8-beta1 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-49521 | ≤ 3.2.5 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.7 | 0.7 % | ||
| CVE-2024-45127 | ≤ 2.4.4-p10 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.5 % | ||
| CVE-2024-45128 | ≤ 2.4.4-p10 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.4 | 0.6 % | ||
| CVE-2024-45133 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | LOW 2.7 | 0.6 % | ||
| CVE-2024-45124 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-45123 | ≤ 2.4.4-p10 | Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79) | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-45121 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-45115 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Authentication (CWE-287) | CRITICAL 9.8 | 1.3 % | ||
| CVE-2024-45117 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Input Validation (CWE-20) | HIGH 7.6 | 0.8 % | ||
| CVE-2024-45116 | ≤ 2.4.4-p10 | Adobe Commerce | Cross-site Scripting (XSS) (CWE-79) | HIGH 8.1 | 0.9 % | ||
| CVE-2024-45122 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.6 % | ||
| CVE-2024-45119 | ≤ 2.4.4-p10 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 4.9 | 0.9 % | ||
| CVE-2024-45135 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | LOW 2.7 | 0.6 % | ||
| CVE-2024-45120 | ≤ 2.4.4-p10 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) | LOW 3.1 | 0.4 % | ||
| CVE-2024-45132 | ≤ 2.4.4-p10 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-45130 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-45131 | ≤ 2.4.4-p10 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 5.4 | 0.5 % | ||
| CVE-2024-45148 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Authentication (CWE-287) | HIGH 8.8 | 0.7 % | ||
| CVE-2024-45134 | ≤ 2.4.4-p10 | Adobe Commerce | Information Exposure (CWE-200) | LOW 2.7 | 0.6 % | ||
| CVE-2024-45129 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-45118 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-45149 | ≤ 2.4.4-p10 | Adobe Commerce | Improper Access Control (CWE-284) | LOW 2.7 | 0.5 % | ||
| CVE-2024-45125 | ≤ 2.4.4-p10 | Adobe Commerce | Incorrect Authorization (CWE-863) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-39419 | ≤ 2.4.4-p9 | A user without ship permissions can ship the orders | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39403 | ≤ 2.4.4-p9 | Stored XSS through Webhook module public key configuration | HIGH 7.6 | 0.5 % | ||
| CVE-2024-39418 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-39413 | ≤ 2.4.4-p9 | An unauthorized user can export the Invoiced Sales Report | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39399 | ≤ 2.4.4-p9 | [Paris] Path Traversal lead to local file read | HIGH 7.7 | 0.9 % | ||
| CVE-2024-39408 | ≤ 2.4.4-p9 | Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-39417 | ≤ 2.4.4-p9 | An unauthorized user can export the Shipping Report | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39410 | ≤ 2.4.4-p9 | Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-39407 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39398 | ≤ 2.4.4-p9 | OTP 2FA can be bruteforced | HIGH 7.4 | 0.9 % | ||
| CVE-2024-39401 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 8.4 | 1.7 % | ||
| CVE-2024-39397 | ≤ 2.4.4-p9 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 9.0 | 1.1 % | ||
| CVE-2024-39409 | ≤ 2.4.4-p9 | Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-39411 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39416 | ≤ 2.4.4-p9 | Unauthorized user can export Orders Sale Report | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39414 | ≤ 2.4.4-p9 | Being able to import/export tax rates without proper privileges | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39412 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39402 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 8.4 | 1.7 % | ||
| CVE-2024-39406 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.8 | 0.9 % | ||
| CVE-2024-39404 | ≤ 2.4.4-p9 | A user without Shop Policy Parameters section privilege can alter the shop policy parameters section | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-39400 | ≤ 2.4.4-p9 | DOM XSS through integrations can impact other admins | HIGH 8.1 | 0.7 % | ||
| CVE-2024-39415 | ≤ 2.4.4-p9 | An unauthorized user can export the Tax Sales Report | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-39405 | ≤ 2.4.4-p9 | Adobe Commerce | Improper Authorization (CWE-285) | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-34106 | ≤ 2.4.4-p8 | Insecure Direct Object Reference - An attacker can able to erase the victim quote details | MEDIUM 5.3 | 0.8 % | ||
| CVE-2024-34103 | ≤ 2.4.4-p8 | Customer account takeover via web API call & subsequent password reset | HIGH 8.1 | 0.9 % | ||
| CVE-2024-34109 | ≤ 2.4.4-p8 | Adobe Commerce | Improper Input Validation (CWE-20) | HIGH 7.2 | 1.4 % | ||
| CVE-2024-34111 | ≤ 2.4.4-p8 | SSRF in service connector | HIGH 8.8 | 1.3 % | ||
| CVE-2024-34110 | ≤ 2.4.4-p8 | RCE in the Adobe Commerce Webhook module through a legit webhook definition | HIGH 7.2 | 1.4 % | ||
| CVE-2024-34107 | ≤ 2.4.4-p8 | Adobe Commerce | Improper Access Control (CWE-284) | CRITICAL 9.8 | 1.1 % | ||
| CVE-2024-34105 | ≤ 2.4.4-p8 | Stored Cross Site Scripting in Order Comment | MEDIUM 4.8 | 0.7 % | ||
| CVE-2024-34104 | ≤ 2.4.4-p8 | Adobe Commerce | Improper Authorization (CWE-285) | HIGH 8.2 | 0.8 % | ||
| CVE-2024-34102 | ≤ 2.4.4-p8 | XXE can expose crypt key and other secrets granting full admin access | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2024-34108 | ≤ 2.4.4-p8 | Large attack surface through legit webhook usage in Adobe Commerce | CRITICAL 9.1 | 1.4 % | ||
| CVE-2024-20758 | ≤ 2.4.7-beta3 | Adobe Commerce | Improper Input Validation (CWE-20) | CRITICAL 9.0 | 1.4 % | ||
| CVE-2024-20759 | ≤ 2.4.7-beta3 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | HIGH 8.1 | 1.0 % | ||
| CVE-2024-20717 | ≤ 2.4.4-p6 | Stored admin XSS via PayPal authentication certificate | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-20716 | ≤ 2.4.4-p6 | Force high-usage of resources by generating unlimited coupons: Adobe Commerce | MEDIUM 4.9 | 0.9 % | ||
| CVE-2024-20718 | ≤ 2.4.4-p6 | [Spain] CSRF to delete Requisition Lists at Adobe Commerce | MEDIUM 6.5 | 0.8 % | ||
| CVE-2024-20719 | ≤ 2.4.4-p6 | [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297 | CRITICAL 9.1 | 1.3 % | ||
| CVE-2024-20720 | ≤ 2.4.4-p6 | Command injection in data collector backup due to insufficient patching of CVE-2023-38208 | CRITICAL 9.1 | 3.7 % | ||
| CVE-2023-38251 | ≤ 2.4.7-beta1 | Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) | MEDIUM 5.3 | 0.8 % | ||
| CVE-2023-38219 | ≤ 2.4.7-beta1 | Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping | HIGH 8.7 | 0.8 % | ||
| CVE-2023-38220 | ≤ 2.4.7-beta1 | Full page cache enumeration via cookie X-Magento-Vary | HIGH 7.5 | 0.8 % | ||
| CVE-2023-26367 | ≤ 2.4.7-beta1 | Error based file extraction via PHP filter chains during product bulk import logic | MEDIUM 4.9 | 0.8 % | ||
| CVE-2023-26366 | ≤ 2.4.7-beta1 | Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 6.8 | 0.9 % | ||
| CVE-2023-38218 | ≤ 2.4.7-beta1 | Incorrect Authorization - Customer account takeover | HIGH 8.8 | 0.9 % | ||
| CVE-2023-38250 | ≤ 2.4.7-beta1 | Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | HIGH 8.0 | 0.8 % |