Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

27 records

Vendor: OpenMage Clear all filters
TI-2026-30484 CVE-2026-42155 · GHSA-2cwr-gcf9-pvxr

Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Priority HIGH 81

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00366 Published 2026-05-15 Fixed in 20.18.0 CWE-330
TI-2026-30747 CVE-2026-42458 · GHSA-x8jv-q8j2-487c

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

Priority MEDIUM 57

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0032 Published 2026-05-15 Fixed in 20.18.0 CWE-87
TI-2026-28925 CVE-2026-40098 · GHSA-665x-ppc4-685w

Missing authorization in OpenMage magento-lts

Priority MEDIUM 57

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00176 Published 2026-04-20 Fixed in 20.17.0 CWE-862
TI-2026-20634 CVE-2026-25525 · GHSA-6vqf-6fhm-7rc6

OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module

Priority MEDIUM 56

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00502 Published 2026-04-20 Fixed in 20.17.0 CWE-184
TI-2026-20633 CVE-2026-25524 · GHSA-fg79-cr9c-7369

OpenMage LTS's Phar Deserialization leads to Remote Code Execution

Priority HIGH 76

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00635 Published 2026-04-20 Fixed in 20.17.0 CWE-502
TI-2025-39617 CVE-2025-64174 · GHSA-qv78-c8hc-438r

OpenMage is vulnerable to XSS in Admin Notifications

Priority MEDIUM 54

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00237 Published 2025-11-06 Fixed in 20.16.0 CWE-79
TI-2025-20235 CVE-2025-27400 · GHSA-5pxh-89cx-4668

Magento vulnerable to stored XSS in theme config fields

Priority LOW 14

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility.

CVSS 3.1LOW 2.9 Adjacent network High privileges User interaction EPSS 0.00256 Published 2025-02-28 Fixed in 20.12.3 CWE-79
TI-2021-04494 CVE-2021-21395 · GHSA-r3c9-9j5q-pwv4

Magneto-lts vulnerable to Cross-Site Request Forgery

Priority MEDIUM 53

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00394 Published 2023-01-27 Fixed in 19.4.22, 20.0.19 CWE-352
TI-2021-12426 CVE-2021-32759 · GHSA-xm9f-vxmx-4m58

Data Flow Sanitation Issue Fix

Priority LOW 35

OpenMage magento-lts is an alternative to the Magento CE official releases.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01797 Published 2021-08-27 Fixed in 19.4.15, 20.0.13 CWE-20
TI-2021-12425 CVE-2021-32758 · GHSA-26rr-v2j2-25fh

Layout XML Arbitrary Code Fix

Priority LOW 36

OpenMage Magento LTS is an alternative to the Magento CE official releases.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02009 Published 2021-08-27 Fixed in 19.4.15, 20.0.11 +1 CWE-91
TI-2021-04525 CVE-2021-21427 · GHSA-fvrf-9428-527m

Backport for CVE-2021-21024 Blind SQLi from Magento 2

Priority MEDIUM 41

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01075 Published 2021-04-21 Fixed in 19.4.13, 20.0.9 CWE-89
TI-2021-04524 CVE-2021-21426 · GHSA-m496-x567-f98c

Fixes a bug in Zend Framework's Stream HTTP Wrapper

Priority MEDIUM 44

Magento-lts is a long-term support alternative to Magento Community Edition (CE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01203 Published 2021-04-21 Fixed in 19.4.13, 20.0.9 CWE-502
TI-2020-16116 CVE-2020-26295

CMS Editor code execution

Priority MEDIUM 42

OpenMage is a community-driven alternative to Magento CE.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.02239 Published 2021-01-21 Fixed in 19.4.10, 20.0.6 CWE-22
TI-2020-16073 CVE-2020-26252

Layout XML RCE Vulnerability in OpenMage

Priority MEDIUM 42

OpenMage is a community-driven alternative to Magento CE.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.02146 Published 2021-01-20 Fixed in 19.4.10, 20.0.6 CWE-22
Load more