Login Request a demo
MA
Product
magento-lts
by OpenMage · last CVE May 15, 2026
18
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 8Medium 8Low 1
Severity
All severities18Critical1High8Medium8Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add magento-lts to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40488
8.8
1%
Apr 20
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Affected: < 20.17.0
CVE-2021-41144
8.8
1%
Jan 27
OpenMage LTS authenticated remote code execution through layout update
Affected: < 19.4.22; >= 20.0.0, < 20.0.19
CVE-2026-25524
8.1
1%
Apr 20
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Affected: < 20.17.0
CVE-2023-41879
7.5
1%
Sep 11
Magento LTS's guest order "protect code" can be brute-forced too easily
Affected: <= 19.5.0; >= 20.0.0, <= 20.1.0
CVE-2023-23617
7.5
1%
Jan 27
OpenMage LTS has DoS vulnerability in MaliciousCode filter
Affected: < 19.4.22; >= 20.0.0, < 20.0.19
CVE-2021-41231
7.2
1%
Jan 27
OpenMage LTS DataFlow upload remote code execution vulnerability
Affected: < 19.4.22; >= 20.0.0, < 20.0.19
CVE-2021-41143
7.2
1%
Jan 27
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
Affected: < 19.4.22; >= 20.0.0, < 20.0.19
CVE-2021-39217
7.2
1%
Jan 27
OpenMage LTS arbitrary command execution in custom layout update through blocks
Affected: < 19.4.22; >= 20.0.0, < 20.0.19
Showing 8