Known vulnerabilities in Adobe Commerce (formerly Magento Commerce) 2.4.0-ext-5

Vendor: Adobe
Version: 2.4.0-ext-5
Software CPE: cpe:2.3:a:adobe:magento_commerce:*:*:*:*:*:*:*:*
Total vulnerabilities: 81
Public exploits: 1
Known exploited (KEV): 2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Adobe Commerce (formerly Magento Commerce) version 2.4.0-ext-5 Adobe Commerce (formerly Magento Commerce) 2.4.0-ext-5 is affected by 81 vulnerabilities: 1 critical, 11 high, 26 medium, 43 low Critical High Medium Low

Vulnerabilities (81)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148857 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-77110
CWE-22 Low
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU148853 - Incorrect Authorization
CVE-2026-77111
CWE-863 Low
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU148855 - Incorrect Authorization
CVE-2026-77774
CWE-863 High
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU148856 - Incorrect Authorization
CVE-2026-76202
CWE-863 High
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU148851 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76200
CWE-79 Medium
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU148852 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76201
CWE-79 Medium
No
No
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 09.09.2026 SB20260907142
#VU147353 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-75650
CWE-1336 Critical
No
Exploited
2.4.4-2026-sep, 2.4.5-2026-sep, 2.4.6-2026-sep, 2.4.7-2026-sep, 2.4.8-2026-sep, 2.4.9-2026-sep 07.09.2026 SB20260907142
#VU131242 - Improper input validation
CVE-2026-34685
CWE-20 Low
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131240 - Improper Authorization
CVE-2026-34656
CWE-285 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131238 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-34658
CWE-79 Low
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131235 - Resource exhaustion
CVE-2026-34654
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131233 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-34686
CWE-79 Low
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131232 - Resource exhaustion
CVE-2026-34652
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131229 - Resource exhaustion
CVE-2026-34649
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131230 - Resource exhaustion
CVE-2026-34650
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131231 - Resource exhaustion
CVE-2026-34651
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131228 - Resource exhaustion
CVE-2026-34648
CWE-400 Medium
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131227 - Server-Side Request Forgery (SSRF)
CVE-2026-34647
CWE-918 High
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131226 - Incorrect Authorization
CVE-2026-34646
CWE-863 High
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109
#VU131225 - Incorrect Authorization
CVE-2026-34645
CWE-863 High
No
No
2.4.4-p18, 2.4.5-p17, 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, 2.4.9 12.05.2026 SB20260512109


Showing elements 1 - 20 out of 81