magento-lts vulnerabilities and CVEs

Known vulnerabilities affecting magento-lts, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

20 vulnerabilities tracked.

• 9.4 OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin… CVE-2026-128049 13 Nov 2026
• 9.2 OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because… CVE-2026-128046 13 Nov 2026
• 9.2 OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with… CVE-2026-128047 13 Nov 2026
• 8.8 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape… CVE-2026-128041 13 Nov 2026
• 8.7 OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauthcallback URLs with a string-prefix check and… CVE-2026-128044 13 Nov 2026
• 8.4 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin… CVE-2026-128040 13 Nov 2026
• 8.3 OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter… CVE-2023-54423 13 Nov 2026
• 7.4 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because… CVE-2026-128030 13 Nov 2026
• 6.9 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration… CVE-2026-128048 13 Nov 2026
• 6.9 OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed… CVE-2026-128045 13 Nov 2026
• 6.3 OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage… CVE-2026-128042 13 Nov 2026
• 5.9 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method… CVE-2026-128032 13 Nov 2026
• 5.3 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in… CVE-2026-128033 13 Nov 2026
• 5.1 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin… CVE-2026-128031 13 Nov 2026
• 5.1 OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template… CVE-2026-128052 13 Nov 2026
• 4.8 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because… CVE-2026-128051 13 Nov 2026
• 2.3 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its… CVE-2026-128053 13 Nov 2026
• 2.3 OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal… CVE-2026-128043 13 Nov 2026
• 2.3 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in… CVE-2026-128028 13 Nov 2026
• 2.3 OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the… CVE-2026-128029 13 Nov 2026