Login Request a demo
CO
E-commerce
Commerce
by Adobe · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
261
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Vulnerabilities261In the news12Timeline
Severity mix
Critical 23High 106Medium 118Low 14
Severity
All severities261Critical23High106Medium118Low14
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Commerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47996
6.8
1%
Jul 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2026-21360
6.8
1%
Mar 11
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16
CVE-2024-39406
6.8
1%
Aug 14
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.4.4-p9
CVE-2023-26366
6.8
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF)…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more
CVE-2023-38250
6.6
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2023-38249
6.6
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2023-38221
6.6
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more
CVE-2021-36043
6.6
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2025-54267
6.5
0%
Oct 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
CVE-2025-27207
6.5
1%
Jun 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p13
CVE-2025-24422
6.5
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24424
6.5
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24427
6.5
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24426
6.5
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24408
6.5
1%
Feb 11
Adobe Commerce | Information Exposure (CWE-200)
Affected: through 2.4.8-beta1
CVE-2024-45132
6.5
1%
Oct 10
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.4-p10
CVE-2024-45118
6.5
1%
Oct 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p10
CVE-2024-20718
6.5
1%
Feb 15
[Spain] CSRF to delete Requisition Lists at Adobe Commerce
Affected: through 2.4.4-p6
CVE-2023-38209
6.5
1%
Aug 9
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +6 more
CVE-2023-29289
6.5
1%
Jun 15
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more
CVE-2021-39864
6.5
2%
Oct 15
Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist…
Affected: through 2.3.7; 2.3.7; 2.4.2; 2.4.2; 2.4.2; 2.4.3
CVE-2021-36039
6.5
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId`…
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36038
6.5
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping…
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36037
6.5
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36012
6.5
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2026-48000
6.1
0%
Jul 14
Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2024-45123
6.1
0%
Oct 10
Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)
Affected: through 2.4.4-p10
CVE-2022-34257
6.1
1%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2021-36027
6.1
1%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by…
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36026
6.1
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address…
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2026-47997
5.9
1%
Jul 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2026-47998
5.9
1%
Jul 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2025-54265
5.9
1%
Oct 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
CVE-2025-49558
5.9
0%
Aug 12
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.4.4-p14
CVE-2026-21293
5.5
0%
Mar 11
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2026-21294
5.5
0%
Mar 11
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2026-48371
5.4
0%
Jul 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2026-21292
5.4
0%
Mar 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-24437
5.4
0%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2025-24428
5.4
0%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2024-45128
5.4
1%
Oct 10
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.4-p10
CVE-2024-45131
5.4
0%
Oct 10
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.4-p10
CVE-2024-39418
5.4
0%
Aug 14
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p9
CVE-2024-20717
5.4
0%
Feb 15
Stored admin XSS via PayPal authentication certificate
Affected: through 2.4.4-p6
CVE-2022-35698
5.4
15%
Oct 14
Adobe Commerce Stored XSS Arbitrary code execution
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.5
CVE-2026-34654
5.3
1%
May 12
Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-21282
5.3
1%
Mar 11
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16
CVE-2026-21286
5.3
0%
Mar 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16
CVE-2026-21310
5.3
0%
Mar 11
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-49559
5.3
1%
Aug 12
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.4.4-p14
Page 1 of 3 · 118 total
123