Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: Adobe Commerce — helpx.adobe.com/security/products/magento/apsb25-26.html Clear all filters
TI-2025-20047 CVE-2025-27190 · GHSA-6wq7-cg9h-mj6q

Adobe Commerce | Improper Access Control (CWE-284)

Priority LOW 31

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00555 Published 2025-04-08 Fixed in 2.4.7-p5, 2.4.6-p10 +3 CWE-284
TI-2025-20048 CVE-2025-27191 · GHSA-vhcq-4xrm-2cr2

Adobe Commerce | Improper Access Control (CWE-284)

Priority LOW 31

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2025-04-08 Fixed in 2.4.7-p5, 2.4.6-p10 +3 CWE-284
TI-2025-20049 CVE-2025-27192 · GHSA-2r94-wm5v-4prx

Adobe Commerce | Insufficiently Protected Credentials (CWE-522)

Priority LOW 14

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00499 Published 2025-04-08 Fixed in 2.4.7-p5, 2.4.6-p10 +3 CWE-522
TI-2025-20045 CVE-2025-27188 · GHSA-rr2g-rrjj-xw86

Adobe Commerce | Incorrect Authorization (CWE-863)

Priority LOW 21

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00594 Published 2025-04-08 Fixed in 2.4.4-p13, 2.4.5-p12 +3 CWE-863
TI-2025-20046 CVE-2025-27189 · GHSA-fpf8-39f6-cgrc

Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

Priority LOW 22

Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01048 Published 2025-04-08 No fix listed CWE-352