AC
Product
Adobe Commerce B2B
On CISA KEVExploited in the wild
75
CVEs
3
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 11High 37Medium 24Low 3
Watch
Add Adobe Commerce B2B to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48000 | 6.1 | Jul 14 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-47997 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-47998 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-21293 | 5.5 | Mar 11 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21294 | 5.5 | Mar 11 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-48371 | 5.4 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-21292 | 5.4 | Mar 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-34654 | 5.3 | May 12 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) Affected: through 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 |
| CVE-2026-21282 | 5.3 | Mar 11 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21286 | 5.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21310 | 5.3 | Mar 11 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-48411 | 4.9 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul |
| CVE-2026-47999 | 4.8 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-34658 | 4.8 | May 12 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 |
| CVE-2026-34655 | 4.8 | May 12 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 |
| CVE-2026-21291 | 4.8 | Mar 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21359 | 4.7 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-95630 | 4.3 | Oct 13 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep |
| CVE-2026-34656 | 4.3 | May 12 | Adobe Commerce | Improper Authorization (CWE-285) Affected: through 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 |
| CVE-2026-21297 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21285 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-21296 | 4.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |
| CVE-2026-48001 | 3.7 | Jul 14 | Adobe Commerce | Information Exposure (CWE-200) Affected: through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 |
| CVE-2026-34685 | 3.4 | May 12 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 |
| CVE-2026-21295 | 3.1 | Mar 11 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: through 1.5.3-alpha3, 1.5.2-p3, 1.4.2-p8, 1.3.5-p13, 1.3.4-p15, 1.3.3-p16 |