CO
E-commerce
Commerce
On CISA KEVExploited in the wild
261
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Severity mix
Critical 23High 106Medium 118Low 14
Watch
Add Commerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24429 | 3.5 | Feb 11 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.8-beta1 |
| CVE-2026-34685 | 3.4 | May 12 | Adobe Commerce | Improper Input Validation (CWE-20) Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 |
| CVE-2026-21295 | 3.1 | Mar 11 | Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15 |
| CVE-2024-45120 | 3.1 | Oct 10 | Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) Affected: through 2.4.4-p10 |
| CVE-2025-49549 | 2.7 | Jun 25 | Adobe Commerce | Incorrect Authorization (CWE-863) Affected: through 2.4.4-p13 |
| CVE-2025-27192 | 2.7 | Apr 8 | Adobe Commerce | Insufficiently Protected Credentials (CWE-522) Affected: through 2.4.8-beta2 |
| CVE-2024-45133 | 2.7 | Oct 10 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.4-p10 |
| CVE-2024-45135 | 2.7 | Oct 10 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.4-p10 |
| CVE-2024-45134 | 2.7 | Oct 10 | Adobe Commerce | Information Exposure (CWE-200) Affected: through 2.4.4-p10 |
| CVE-2024-45149 | 2.7 | Oct 10 | Adobe Commerce | Improper Access Control (CWE-284) Affected: through 2.4.4-p10 |
| CVE-2023-29293 | 2.7 | Jun 15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a… Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +2 more |