Product by Openmage

    Magento-lts

    47 known vulnerabilities in Magento-lts (Openmage), 0 of them actively exploited (CISA KEV).

    Key figures

    47

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Magento-lts (Openmage)
    HighCVE-2020-26285

    Widget instances allows a hacker to inject an executable file on the server on OpenMage

    also in 1 other product

    		8.7
    CriticalCVE-2026-128046

    OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

    		8.1
    HighCVE-2020-26295

    CMS Editor code execution

    also in 1 other product

    		8.7
    HighCVE-2020-26252

    Layout XML RCE Vulnerability in OpenMage

    also in 1 other product

    		8.7
    CriticalCVE-2026-128047

    OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

    		8.1
    HighCVE-2021-32758

    Layout XML Arbitrary Code Fix

    also in 1 other product

    		7.2
    CriticalCVE-2021-21426

    Fixes a bug in Zend Framework's Stream HTTP Wrapper

    also in 1 other product

    		9.8
    HighCVE-2021-32759

    Data Flow Sanitation Issue Fix

    also in 1 other product

    		7.2
    HighCVE-2021-41144

    OpenMage LTS authenticated remote code execution through layout update

    also in 1 other product

    		8.8
    HighCVE-2026-128041

    OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed

    		8.0
    HighCVE-2026-40488

    OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

    also in 1 other product

    		8.8
    CriticalCVE-2021-21427

    Backport for CVE-2021-21024 Blind SQLi from Magento 2

    also in 1 other product

    		9.1
    HighCVE-2021-39217

    OpenMage LTS arbitrary command execution in custom layout update through blocks

    also in 1 other product

    		7.2
    HighCVE-2023-41879

    Magento LTS's guest order "protect code" can be brute-forced too easily

    also in 1 other product

    		7.5
    HighCVE-2020-15244

    RCE in Magento

    also in 1 other product

    		8.0
    HighCVE-2021-41143

    OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

    also in 1 other product

    		7.2
    HighCVE-2021-41231

    OpenMage LTS DataFlow upload remote code execution vulnerability

    also in 1 other product

    		7.2
    HighCVE-2026-25524

    OpenMage LTS's Phar Deserialization leads to Remote Code Execution

    also in 1 other product

    		8.1
    CriticalCVE-2026-128049

    OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm

    		9.0
    HighCVE-2023-54423

    OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor

    		7.5
    HighCVE-2026-128044

    OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass

    		7.7
    HighCVE-2026-128040

    OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields

    		6.1
    CriticalCVE-2026-42155

    Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

    		—
    HighCVE-2020-15151

    Observable Timing Discrepancy in OpenMage LTS

    also in 1 other product

    		8.0
    HighCVE-2026-128030

    OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation

    		5.9

    All vulnerabilities in search

    All products by Openmage