Known vulnerabilities in magento-lts

Vendor: OPENMAGE
Software: magento-lts
Software CPE: cpe:2.3:a:openmage:magento-lts:*:*:*:*:*:*:*:*
Total vulnerabilities: 31
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting magento-lts magento-lts is affected by 31 known vulnerabilities: 6 high, 7 medium, 18 low Critical High Medium Low

Vulnerabilities (31)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU129646 - Improper Neutralization of Alternate XSS Syntax
CVE-2026-42458
CWE-87 Low
No
No
20.18.0 05.05.2026 SB2026050512
#VU129645 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-42207
CWE-601 Medium
No
No
20.18.0 05.05.2026 SB2026050512
#VU129644 - Use of Insufficiently Random Values
CVE-2026-42155
CWE-330 High
No
No
20.18.0 05.05.2026 SB2026050512
#VU126487 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-25525
CWE-22 Low
No
No
20.17.0 20.04.2026 SB2026042017
#VU126486 - Deserialization of Untrusted Data
CVE-2026-25524
CWE-502 High
No
No
20.17.0 20.04.2026 SB2026042017
#VU126485 - Authorization Bypass Through User-Controlled Key
CVE-2026-40098
CWE-639 Medium
No
No
20.17.0 20.04.2026 SB2026042017
#VU126484 - Improper input validation
CVE-2026-40488
CWE-20 High
No
No
20.17.0 20.04.2026 SB2026042017
#VU122243 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
20.16.1 03.02.2026 SB2026020317
#VU117886 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-64174
CWE-79 Low
No
No
20.16.0 01.11.2025 SB2025110107
#VU105168 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27400
CWE-79 Low
No
No
20.12.3 28.02.2025 SB2025022883
#VU94794 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-41676
CWE-79 Low
No
No
20.10.1 28.07.2024 SB2024072802
#VU86464 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20717
CWE-79 Low
No
No
19.5.3, 20.5.0 13.02.2024 SB2024021368
SB2024022805
#VU83987 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
20.2.0 08.12.2023 SB2023120802
#VU80639 - Improper Control of Interaction Frequency
CVE-2023-41879
CWE-799 Low
No
No
19.5.1, 20.1.1 12.09.2023 SB2023091222
#VU71773 - Incorrect Regular Expression
CVE-2020-27511
CWE-185 Low
No
No
19.4.23, 20.0.20 02.02.2023 SB2021062151
SB2023020250
SB2024050725
and 1 more
#VU71576 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2023-23617
CWE-835 Medium
No
No
19.4.22, 20.0.19 26.01.2023 SB2023012643
#VU71574 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-41144
CWE-94 Medium
No
No
19.4.22, 20.0.19 26.01.2023 SB2023012643
#VU71573 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-39217
CWE-78 Low
No
No
19.4.22, 20.0.19 26.01.2023 SB2023012643
#VU71572 - Improper input validation
CVE-2021-41143
CWE-20 Low
No
No
19.4.13, 20.0.11 26.01.2023 SB2023012642
#VU71571 - Cross-Site Request Forgery (CSRF)
CVE-2021-21395
CWE-352 Medium
No
No
19.4.22, 20.0.19 26.01.2023 SB2023012643


Showing elements 1 - 20 out of 31