Read the docs

OpenMage

Records27All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9

Exploited now

OpenMage records in CISA KEV

No OpenMage vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Magento 18 records HIGH Openmage 4 records MEDIUM Openmage Long Term Support 1 record LOW

Records

27 records

TI-2026-30484 CVE-2026-42155 · GHSA-2cwr-gcf9-pvxr

Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Priority HIGH 81

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00366 Published 2026-05-15 Fixed in 20.18.0 CWE-330
TI-2026-20633 CVE-2026-25524 · GHSA-fg79-cr9c-7369

OpenMage LTS's Phar Deserialization leads to Remote Code Execution

Priority HIGH 76

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00635 Published 2026-04-20 Fixed in 20.17.0 CWE-502
TI-2026-30747 CVE-2026-42458 · GHSA-x8jv-q8j2-487c

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

Priority MEDIUM 57

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0032 Published 2026-05-15 Fixed in 20.18.0 CWE-87
TI-2026-28925 CVE-2026-40098 · GHSA-665x-ppc4-685w

Missing authorization in OpenMage magento-lts

Priority MEDIUM 57

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00176 Published 2026-04-20 Fixed in 20.17.0 CWE-862
TI-2026-20634 CVE-2026-25525 · GHSA-6vqf-6fhm-7rc6

OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module

Priority MEDIUM 56

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00502 Published 2026-04-20 Fixed in 20.17.0 CWE-184
TI-2025-39617 CVE-2025-64174 · GHSA-qv78-c8hc-438r

OpenMage is vulnerable to XSS in Admin Notifications

Priority MEDIUM 54

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00237 Published 2025-11-06 Fixed in 20.16.0 CWE-79
TI-2021-04494 CVE-2021-21395 · GHSA-r3c9-9j5q-pwv4

Magneto-lts vulnerable to Cross-Site Request Forgery

Priority MEDIUM 53

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00394 Published 2023-01-27 Fixed in 19.4.22, 20.0.19 CWE-352
TI-2021-04524 CVE-2021-21426 · GHSA-m496-x567-f98c

Fixes a bug in Zend Framework's Stream HTTP Wrapper

Priority MEDIUM 44

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01203 Published 2021-04-21 Fixed in 19.4.13, 20.0.9 CWE-502
TI-2020-16116 CVE-2020-26295

CMS Editor code execution

Priority MEDIUM 42

OpenMage is a community-driven alternative to Magento CE.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.02239 Published 2021-01-21 Fixed in 19.4.10, 20.0.6 CWE-22
TI-2020-16073 CVE-2020-26252

Layout XML RCE Vulnerability in OpenMage

Priority MEDIUM 42

OpenMage is a community-driven alternative to Magento CE.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.02146 Published 2021-01-20 Fixed in 19.4.10, 20.0.6 CWE-22
TI-2021-04525 CVE-2021-21427 · GHSA-fvrf-9428-527m

Backport for CVE-2021-21024 Blind SQLi from Magento 2

Priority MEDIUM 41

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01075 Published 2021-04-21 Fixed in 19.4.13, 20.0.9 CWE-89
TI-2020-12016 CVE-2020-15244 · GHSA-jrgf-vfw2-hj26

RCE in Magento

Priority LOW 37

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01264 Published 2020-10-21 Fixed in 19.4.8, 20.0.4 CWE-502
TI-2020-11923 CVE-2020-15151 · GHSA-crf2-xm6x-46p6

Observable Timing Discrepancy in OpenMage LTS

Priority LOW 37

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00931 Published 2020-08-19 Fixed in 20.0.2, 19.4.6 CWE-203
TI-2021-12425 CVE-2021-32758 · GHSA-26rr-v2j2-25fh

Layout XML Arbitrary Code Fix

Priority LOW 36

OpenMage Magento LTS is an alternative to the Magento CE official releases.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02009 Published 2021-08-27 Fixed in 19.4.15, 20.0.11 +1 CWE-91
TI-2021-12426 CVE-2021-32759 · GHSA-xm9f-vxmx-4m58

Data Flow Sanitation Issue Fix

Priority LOW 35

OpenMage magento-lts is an alternative to the Magento CE official releases.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01797 Published 2021-08-27 Fixed in 19.4.15, 20.0.13 CWE-20
Load more
Open these records in search →