Product by Openmage

    Magento

    19 known vulnerabilities in Magento (Openmage), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Magento (Openmage)
    CriticalCVE-2021-21426

    Fixes a bug in Zend Framework's Stream HTTP Wrapper

    also in 1 other product

    		9.8
    HighCVE-2021-32759

    Data Flow Sanitation Issue Fix

    also in 1 other product

    		7.2
    HighCVE-2021-41144

    OpenMage LTS authenticated remote code execution through layout update

    also in 1 other product

    		8.8
    HighCVE-2026-40488

    OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

    also in 1 other product

    		8.8
    CriticalCVE-2021-21427

    Backport for CVE-2021-21024 Blind SQLi from Magento 2

    also in 1 other product

    		9.1
    HighCVE-2021-39217

    OpenMage LTS arbitrary command execution in custom layout update through blocks

    also in 1 other product

    		7.2
    HighCVE-2023-41879

    Magento LTS's guest order "protect code" can be brute-forced too easily

    also in 1 other product

    		7.5
    HighCVE-2020-15244

    RCE in Magento

    also in 1 other product

    		8.0
    HighCVE-2021-41143

    OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

    also in 1 other product

    		7.2
    HighCVE-2021-41231

    OpenMage LTS DataFlow upload remote code execution vulnerability

    also in 1 other product

    		7.2
    HighCVE-2026-25524

    OpenMage LTS's Phar Deserialization leads to Remote Code Execution

    also in 1 other product

    		8.1
    HighCVE-2020-15151

    Observable Timing Discrepancy in OpenMage LTS

    also in 2 other products

    		8.0
    HighCVE-2023-23617

    OpenMage LTS has DoS vulnerability in MaliciousCode filter

    also in 1 other product

    		4.9
    MediumCVE-2026-25525

    OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module

    also in 1 other product

    		4.9
    MediumCVE-2026-25523

    Magento's X-Original-Url header can expose admin url

    also in 1 other product

    		5.3
    MediumCVE-2026-40098

    OpenMage Magento-lts: Missing Authorization

    also in 1 other product

    		5.4
    MediumCVE-2025-64174

    OpenMage is vulnerable to XSS in Admin Notifications

    also in 1 other product

    		4.8
    MediumCVE-2024-41676

    Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

    also in 1 other product

    		4.1
    MediumCVE-2021-21395

    Magneto-lts vulnerable to Cross-Site Request Forgery

    also in 1 other product

    		4.2

    All products by Openmage