# cve.now: Openmage

The newest entries naming Openmage as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-42207](https://cve.now/CVE-2026-42207.md): Magento LTS: Open Redirect via Unvalidated \`uenc\` Parameter in \`stockAction()\` - magento-lts (CVSS 6.1)
- [CVE-2026-42155](https://cve.now/CVE-2026-42155.md): Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs (CVSS 9.3)
- [CVE-2026-42458](https://cve.now/CVE-2026-42458.md): Magento LTS: Reflected XSS - Import -\> Data Flow (profiles) (CVSS 5.3)
- [CVE-2026-40488](https://cve.now/CVE-2026-40488.md): OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution (CVSS 8.7)
- [CVE-2026-40098](https://cve.now/CVE-2026-40098.md): OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant (CVSS 5.3)
- [CVE-2026-25525](https://cve.now/CVE-2026-25525.md): OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module (CVSS 4.9)
- [CVE-2026-25524](https://cve.now/CVE-2026-25524.md): OpenMage LTS's Phar Deserialization leads to Remote Code Execution (CVSS 8.1)
- [CVE-2026-25523](https://cve.now/CVE-2026-25523.md): Magento's X-Original-Url header can expose admin url (CVSS 5.3)
- [CVE-2025-64174](https://cve.now/CVE-2025-64174.md): OpenMage is vulnerable to XSS in Admin Notifications (CVSS 4.6)
- [CVE-2025-27400](https://cve.now/CVE-2025-27400.md): Magento vulnerable to stored XSS in theme config fields (CVSS 2.9)
- [CVE-2024-41676](https://cve.now/CVE-2024-41676.md): Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs (CVSS 4.1)
- [CVE-2023-41879](https://cve.now/CVE-2023-41879.md): Magento LTS's guest order "protect code" can be brute-forced too easily (CVSS 7.5)
- [CVE-2023-23617](https://cve.now/CVE-2023-23617.md): OpenMage LTS has DoS vulnerability in MaliciousCode filter (CVSS 4.9)
- [CVE-2021-41231](https://cve.now/CVE-2021-41231.md): OpenMage LTS DataFlow upload remote code execution vulnerability (CVSS 7.2)
- [CVE-2021-41144](https://cve.now/CVE-2021-41144.md): OpenMage LTS authenticated remote code execution through layout update (CVSS 8.8)
- [CVE-2021-41143](https://cve.now/CVE-2021-41143.md): OpenMage LTS arbitrary file deletion in customer media allows for remote code execution (CVSS 7.2)
- [CVE-2021-39217](https://cve.now/CVE-2021-39217.md): OpenMage LTS arbitrary command execution in custom layout update through blocks (CVSS 7.2)
- [CVE-2021-21395](https://cve.now/CVE-2021-21395.md): Magneto-lts vulnerable to Cross-Site Request Forgery (CVSS 4.2)
- [CVE-2021-32759](https://cve.now/CVE-2021-32759.md): Data Flow Sanitation Issue Fix (CVSS 7.2)
- [CVE-2021-32758](https://cve.now/CVE-2021-32758.md): Layout XML Arbitrary Code Fix (CVSS 7.2)
- [CVE-2021-21427](https://cve.now/CVE-2021-21427.md): Backport for CVE-2021-21024 Blind SQLi from Magento 2 (CVSS 9.1)
- [CVE-2021-21426](https://cve.now/CVE-2021-21426.md): Fixes a bug in Zend Framework's Stream HTTP Wrapper (CVSS 9.8)
- [CVE-2020-26295](https://cve.now/CVE-2020-26295.md): CMS Editor code execution (CVSS 8.7)
- [CVE-2020-26285](https://cve.now/CVE-2020-26285.md): Widget instances allows a hacker to inject an executable file on the server on OpenMage (CVSS 8.7)
- [CVE-2020-26252](https://cve.now/CVE-2020-26252.md): Layout XML RCE Vulnerability in OpenMage (CVSS 8.7)
- [CVE-2020-15244](https://cve.now/CVE-2020-15244.md): RCE in Magento (CVSS 8.0)
- [CVE-2020-15151](https://cve.now/CVE-2020-15151.md): Observable Timing Discrepancy in OpenMage LTS (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openmage
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.