CO
E-commerce
Commerce
On CISA KEVExploited in the wild
261
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 23High 106Medium 118Low 14
Watch
Add Commerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-36039 | 6.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId`… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36038 | 6.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36037 | 6.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36012 | 6.5 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2026-48000 | 6.1 | Jul 14 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2024-45123 | 6.1 | Oct 10 | Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79) Affected: through 2.4.4-p10 |
| CVE-2022-34257 | 6.1 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-36027 | 6.1 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2021-36026 | 6.1 | Sep 1 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address… Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2 |
| CVE-2026-47997 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 |
| CVE-2026-47998 | 5.9 | Jul 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2025-54265 | 5.9 | Oct 14 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 |
| CVE-2025-49558 | 5.9 | Aug 12 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) Affected: through 2.4.4-p14 |
| CVE-2026-21293 | 5.5 | Mar 11 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2026-21294 | 5.5 | Mar 11 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2026-48371 | 5.4 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 |
| CVE-2026-21292 | 5.4 | Mar 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2025-24437 | 5.4 | Feb 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.8-beta1 |
| CVE-2025-24428 | 5.4 | Feb 11 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.8-beta1 |
| CVE-2024-45128 | 5.4 | Oct 10 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.4-p10 |
| CVE-2024-45131 | 5.4 | Oct 10 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.4-p10 |
| CVE-2024-39418 | 5.4 | Aug 14 | Adobe Commerce | Improper Authorization (CWE-285) Affected: through 2.4.4-p9 |
| CVE-2024-20717 | 5.4 | Feb 15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +11 more |
| CVE-2022-35698 | 5.4 | Oct 14 | Adobe Commerce Stored XSS Arbitrary code execution Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.5 |
| CVE-2026-34654 | 5.3 | May 12 | Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14 |
| CVE-2026-21282 | 5.3 | Mar 11 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 |
| CVE-2026-21286 | 5.3 | Mar 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2026-21310 | 5.3 | Mar 11 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2025-49559 | 5.3 | Aug 12 | Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Affected: through 2.4.4-p14 |
| CVE-2025-27206 | 5.3 | Jun 10 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.4-p13 |
| CVE-2025-27190 | 5.3 | Apr 8 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.8-beta2 |
| CVE-2025-27191 | 5.3 | Apr 8 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.8-beta2 |
| CVE-2025-24425 | 5.3 | Feb 11 | Adobe Commerce | Business Logic Errors (CWE-840) Affected: through 2.4.8-beta1 |
| CVE-2024-45124 | 5.3 | Oct 10 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.4-p10 |
| CVE-2024-34106 | 5.3 | Jun 13 | Insecure Direct Object Reference - An attacker can able to erase the victim quote details Affected: through 2.4.4-p8 |
| CVE-2023-38251 | 5.3 | Oct 13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more |
| CVE-2023-29290 | 5.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2023-29287 | 5.3 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +2 more |
| CVE-2023-22250 | 5.3 | Mar 27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5 |
| CVE-2022-35689 | 5.3 | Oct 14 | Adobe Commerce Improper Access Control Security feature bypass Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.5 |
| CVE-2022-35692 | 5.3 | Aug 19 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… Affected: 2.4.0 before 2.4.4 |
| CVE-2022-34259 | 5.3 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-21012 | 5.3 | Jan 13 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module Affected: through 2.3.6; 2.4.0; 2.4.0; 2.4.1 |
| CVE-2026-48411 | 4.9 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul |
| CVE-2024-45119 | 4.9 | Oct 10 | Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) Affected: through 2.4.4-p10 |
| CVE-2024-20716 | 4.9 | Feb 15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4; +11 more |
| CVE-2023-26367 | 4.9 | Oct 13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more |
| CVE-2023-29292 | 4.9 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2023-29291 | 4.9 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead… Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more |
| CVE-2026-47999 | 4.8 | Jul 14 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 |