- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 24 · 3 critical, 11 high, 9 medium, 1 low
- Registry
- Packagist
Advisories 24
- CVE-2026-42207Medium 6.1
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
Affected: fixed in 20.18.0.
- CVE-2026-42155Critical 9.3
Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Affected: fixed in 20.18.0.
- CVE-2026-42458Medium 5.3
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Affected: fixed in 20.18.0.
- CVE-2026-40488High 8.7
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Affected: fixed in 20.17.0.
- CVE-2026-40098Medium 5.3
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Affected: fixed in 20.17.0.
- CVE-2026-25525Medium 4.9
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Affected: fixed in 20.17.0.
- CVE-2026-25524High 8.1
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Affected: fixed in 20.17.0.
- CVE-2026-25523Medium 5.3
Magento's X-Original-Url header can expose admin url
Affected: fixed in 20.16.1.
- CVE-2025-64174Medium 4.6
OpenMage is vulnerable to XSS in Admin Notifications
Affected: fixed in 20.16.0.
- CVE-2025-27400Low 2.9
Magento vulnerable to stored XSS in theme config fields
Affected: fixed in 20.12.3.
- CVE-2024-41676Medium 4.1
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Affected: fixed in 20.10.1.
- CVE-2023-41879High 7.5
Magento LTS's guest order "protect code" can be brute-forced too easily
Affected: fixed in 19.5.1; from 20.0.0, fixed in 20.1.1.
- CVE-2023-23617Medium 4.9
OpenMage LTS has DoS vulnerability in MaliciousCode filter
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
- CVE-2021-41231High 7.2
OpenMage LTS DataFlow upload remote code execution vulnerability
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
- CVE-2021-41144High 8.8
OpenMage LTS authenticated remote code execution through layout update
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
Show all 24 advisoriesShow fewer advisories
- CVE-2021-41143High 7.2
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
- CVE-2021-39217High 7.2
OpenMage LTS arbitrary command execution in custom layout update through blocks
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
- CVE-2021-21395Medium 4.2
Magneto-lts vulnerable to Cross-Site Request Forgery
Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19.
- CVE-2021-32759High 7.2
Data Flow Sanitation Issue Fix
Affected: fixed in 19.4.15; from 20.0.0, fixed in 20.0.13.
- CVE-2021-32758High 7.2
Layout XML Arbitrary Code Fix
Affected: fixed in 19.4.15; from 20.0.0, fixed in 20.0.13.
- CVE-2021-21427Critical 9.1
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Affected: fixed in 19.4.13; from 20.0.0, fixed in 20.0.9.
- CVE-2021-21426Critical 9.8
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Affected: fixed in 19.4.13; from 20.0.0, fixed in 20.0.9.
- CVE-2020-15244High 8.0
RCE in Magento
Affected: fixed in 19.4.8; from 20.0.0, fixed in 20.0.4.
- CVE-2020-15151High 8.0
Observable Timing Discrepancy in OpenMage LTS
Affected: fixed in 19.4.6; from 20.0.0, fixed in 20.0.2.