Login Request a demo
CO
E-commerce
Commerce
by Adobe · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
261
CVEs
6
On KEV
10.0
Max CVSS
11
New 30D
Vulnerabilities261In the news12Timeline
Severity mix
Critical 23High 106Medium 118Low 14
Severity
All severities261Critical23High106Medium118Low14
Exploitation
On CISA KEV6Exploited in the wild6
Watch

Add Commerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-45148
8.8
1%
Oct 10
Adobe Commerce | Improper Authentication (CWE-287)
Affected: through 2.4.4-p10
CVE-2024-34111
8.8
1%
Jun 13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2023-38218
8.8
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization
Affected: 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.5; 2.4.5; +7 more
CVE-2022-42344
8.8
1%
Oct 20
[CVE-2021-36032] Magento IDOR Leads to Account Takeover
Affected: through 2.4.3-p2
CVE-2022-34255
8.8
2%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2022-34254
8.8
2%
Aug 16
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory…
Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more
CVE-2021-36032
8.8
2%
Sep 1
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability
Affected: 2.3.0 through 2.3.7; 2.4.0 through 2.4.2; 2.4.2
CVE-2026-95631
8.7
1%
Oct 13
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
CVE-2026-92911
8.7
1%
Oct 13
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep
CVE-2026-77111
8.7
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
CVE-2026-48414
8.7
0%
Aug 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-48413
8.7
1%
Aug 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
CVE-2026-47994
8.7
1%
Jul 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
CVE-2026-34686
8.7
0%
May 12
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-34653
8.7
1%
May 12
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17
CVE-2026-21290
8.7
0%
Mar 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-49557
8.7
1%
Aug 12
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.4-p14
CVE-2025-24414
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24415
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24416
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24413
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24438
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24417
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24412
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2025-24410
8.7
1%
Feb 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.8-beta1
CVE-2023-38219
8.7
1%
Oct 13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS)…
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2026-77109
8.6
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
CVE-2026-77774
8.6
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
CVE-2026-47988
8.6
1%
Jul 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2025-47110
8.4
1%
Jun 10
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.4-p13
CVE-2024-39401
8.4
2%
Aug 14
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: through 2.4.4-p9
CVE-2024-39402
8.4
2%
Aug 14
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: through 2.4.4-p9
CVE-2026-92908
8.3
1%
Oct 13
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-48415
8.3
1%
Aug 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
CVE-2026-76202
8.2
1%
Sep 8
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug
CVE-2026-47984
8.2
1%
Jul 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2025-43585
8.2
1%
Jun 10
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.4-p13
CVE-2025-24409
8.2
1%
Feb 11
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.8-beta1
CVE-2024-34104
8.2
1%
Jun 13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass
Affected: 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +34 more
CVE-2026-92922
8.1
1%
Oct 13
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep
CVE-2026-47995
8.1
1%
Jul 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
CVE-2026-21284
8.1
0%
Mar 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2026-21361
8.1
0%
Mar 11
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15
CVE-2025-54263
8.1
1%
Oct 14
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
CVE-2025-54264
8.1
1%
Oct 14
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15
CVE-2025-49555
8.1
1%
Aug 12
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.4.4-p14
CVE-2025-43586
8.1
1%
Jun 10
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.4-p13
CVE-2025-24411
8.1
1%
Feb 11
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.4.8-beta1
CVE-2025-24418
8.1
1%
Feb 11
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.4.8-beta1
CVE-2024-45116
8.1
1%
Oct 10
Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)
Affected: through 2.4.4-p10
Page 1 of 3 · 106 total
123