Commerce vulnerabilities | LiveThreat CVE Feed

E-commerce

Commerce

by Adobe · last CVE Oct 13, 2026

On CISA KEVExploited in the wild

264

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities264 In the news12 Timeline

Severity mix

Critical 23High 109Medium 118Low 14

Severity

All severities264 Critical23 High109 Medium118 Low14

Exploitation

On CISA KEV6 Exploited in the wild6

Watch

Add Commerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-36034	7.2	2%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36033	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36031	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]`… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36029	7.2	2%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36028	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36025	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36024	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2021-36022	7.2	3%	Sep 1	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2025-24407	7.1	1%	Feb 11	Adobe Commerce \| Incorrect Authorization (CWE-863) Affected: through 2.4.8-beta1