Openmage vulnerabilities
27 CVEs and advisories name Openmage as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-42207Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
- CVE-2026-42155Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
- CVE-2026-42458Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
- CVE-2026-40488OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2026-40098OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
- CVE-2026-25525OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
- CVE-2026-25524OpenMage LTS's Phar Deserialization leads to Remote Code Execution
- CVE-2026-25523Magento's X-Original-Url header can expose admin url
- CVE-2025-64174OpenMage is vulnerable to XSS in Admin Notifications
- CVE-2025-27400Magento vulnerable to stored XSS in theme config fields
- CVE-2024-41676Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
- CVE-2023-41879Magento LTS's guest order "protect code" can be brute-forced too easily
- CVE-2023-23617OpenMage LTS has DoS vulnerability in MaliciousCode filter
- CVE-2021-41231OpenMage LTS DataFlow upload remote code execution vulnerability
- CVE-2021-41144OpenMage LTS authenticated remote code execution through layout update
- CVE-2021-41143OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
- CVE-2021-39217OpenMage LTS arbitrary command execution in custom layout update through blocks
- CVE-2021-21395Magneto-lts vulnerable to Cross-Site Request Forgery
- CVE-2021-32759Data Flow Sanitation Issue Fix
- CVE-2021-32758Layout XML Arbitrary Code Fix
- CVE-2021-21427Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-21426Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2020-26295CMS Editor code execution
- CVE-2020-26285Widget instances allows a hacker to inject an executable file on the server on OpenMage
- CVE-2020-26252Layout XML RCE Vulnerability in OpenMage
- CVE-2020-15244RCE in Magento
- CVE-2020-15151Observable Timing Discrepancy in OpenMage LTS