Login Request a demo
CO
E-commerce
Commerce
by Adobe · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
261
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Vulnerabilities261In the news12Timeline
Severity mix
Critical 23High 106Medium 118Low 14
Severity
All severities261Critical23High106Medium118Low14
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Commerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34658
4.8
0%
May 12
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
CVE-2026-34655
4.8
0%
May 12
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-21291
4.8
0%
Mar 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-54266
4.8
0%
Oct 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
CVE-2024-45127
4.8
0%
Oct 10
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.4-p10
CVE-2024-34105
4.8
1%
Jun 13
Stored Cross Site Scripting in Order Comment
Affected: through 2.4.4-p8
CVE-2023-22249
4.8
58%
Mar 27
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a…
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5
CVE-2022-34258
4.8
69%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2026-21359
4.7
0%
Mar 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2026-95630
4.3
0%
Oct 13
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
CVE-2026-34656
4.3
0%
May 12
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
CVE-2026-21297
4.3
0%
Mar 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16
CVE-2026-21285
4.3
0%
Mar 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16
CVE-2026-21296
4.3
0%
Mar 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-49550
4.3
0%
Jun 25
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.4-p13
CVE-2025-27188
4.3
1%
Apr 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta2
CVE-2025-27189
4.3
1%
Apr 8
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.4.8-beta2
CVE-2025-24420
4.3
1%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2025-24419
4.3
1%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2025-24436
4.3
1%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2025-24423
4.3
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24421
4.3
1%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2025-24435
4.3
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2024-45121
4.3
1%
Oct 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p10
CVE-2024-45122
4.3
1%
Oct 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p10
CVE-2024-45130
4.3
1%
Oct 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p10
CVE-2024-45129
4.3
1%
Oct 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p10
CVE-2024-45125
4.3
1%
Oct 10
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.4-p10
CVE-2024-39419
4.3
0%
Aug 14
A user without ship permissions can ship the orders
Affected: through 2.4.4-p9
CVE-2024-39413
4.3
0%
Aug 14
An unauthorized user can export the Invoiced Sales Report
Affected: through 2.4.4-p9
CVE-2024-39408
4.3
0%
Aug 14
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.4.4-p9
CVE-2024-39417
4.3
0%
Aug 14
An unauthorized user can export the Shipping Report
Affected: through 2.4.4-p9
CVE-2024-39410
4.3
0%
Aug 14
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.4.4-p9
CVE-2024-39407
4.3
0%
Aug 14
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p9
CVE-2024-39409
4.3
0%
Aug 14
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.4.4-p9
CVE-2024-39411
4.3
0%
Aug 14
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p9
CVE-2024-39416
4.3
0%
Aug 14
Unauthorized user can export Orders Sale Report
Affected: through 2.4.4-p9
CVE-2024-39414
4.3
0%
Aug 14
Being able to import/export tax rates without proper privileges
Affected: through 2.4.4-p9
CVE-2024-39412
4.3
0%
Aug 14
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p9
CVE-2024-39404
4.3
0%
Aug 14
A user without Shop Policy Parameters section privilege can alter the shop policy parameters section
Affected: through 2.4.4-p9
CVE-2024-39415
4.3
0%
Aug 14
An unauthorized user can export the Tax Sales Report
Affected: through 2.4.4-p9
CVE-2024-39405
4.3
0%
Aug 14
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p9
CVE-2023-29296
4.3
1%
Jun 15
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more
CVE-2023-29295
4.3
1%
Jun 15
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more
CVE-2023-29294
4.3
1%
Jun 15
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +21 more
CVE-2023-29288
4.3
1%
Jun 15
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a…
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +2 more
CVE-2023-22251
4.3
1%
Mar 27
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability
Affected: before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5
CVE-2026-48001
3.7
1%
Jul 14
Adobe Commerce | Information Exposure (CWE-200)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2025-24432
3.7
0%
Feb 11
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.4.8-beta1
CVE-2025-24430
3.7
0%
Feb 11
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.4.8-beta1
Page 5 of 6 · 261 total
1…456