VendorsAdobecommerceall versions
Vulnerabilities

Adobe Commerce

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

208CVEs
CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
Published 2022-02-16 · Analyzed
10.0KEVEPSS 0.992
CVE-2022-35698
Adobe Commerce Stored XSS Arbitrary code execution
Published 2022-10-14 · Modified
10.0EPSS 0.109
CVE-2026-75650
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Published 2026-09-07 · Analyzed
10.0KEVEPSS 0.021
CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
Published 2024-06-13 · Analyzed
9.8KEVEPSS 1.000
CVE-2022-34256
Adobe Commerce Improper Authorization Privilege escalation
Published 2022-08-16 · Modified
9.8EPSS 0.021
CVE-2024-45115
Adobe Commerce | Improper Authentication (CWE-287)
Published 2024-10-10 · Analyzed
9.8EPSS 0.013
CVE-2024-34107
Adobe Commerce | Improper Access Control (CWE-284)
Published 2024-06-13 · Modified
9.8EPSS 0.011
CVE-2026-48356
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Published 2026-07-14 · Analyzed
9.3EPSS 0.010
CVE-2026-76200
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2026-09-08 · Analyzed
9.3EPSS 0.005
CVE-2026-76201
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2026-09-08 · Analyzed
9.3EPSS 0.005
CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
Published 2025-09-09 · Analyzed
9.1KEVEPSS 0.945
CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
Published 2026-08-11 · Analyzed
9.1EPSS 0.245
CVE-2025-24434
Adobe Commerce | Incorrect Authorization (CWE-863)
Published 2025-02-11 · Analyzed
9.1EPSS 0.172
CVE-2022-34253
Adobe Commerce XML Injection Arbitrary code execution
Published 2022-08-16 · Modified
9.1EPSS 0.049
CVE-2024-20720
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Published 2024-02-15 · Modified
9.1EPSS 0.037
CVE-2023-38208
Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Published 2023-08-09 · Modified
9.1EPSS 0.023
CVE-2026-48358
Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
Published 2026-07-14 · Analyzed
9.1EPSS 0.015
CVE-2022-24093
Adobe Commerce post-auth improper input validation leads to remote code execution
Published 2023-09-12 · Modified
9.1EPSS 0.015
CVE-2024-34108
Large attack surface through legit webhook usage in Adobe Commerce
Published 2024-06-13 · Modified
9.1EPSS 0.014
CVE-2023-29297
Admin-to-admin stored XSS via cache poisoning
Published 2023-06-15 · Modified
9.1EPSS 0.014
CVE-2024-20719
[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
Published 2024-02-15 · Modified
9.1EPSS 0.013
CVE-2024-20758
Adobe Commerce | Improper Input Validation (CWE-20)
Published 2024-04-10 · Analyzed
9.0EPSS 0.014
CVE-2024-39397
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Published 2024-08-14 · Analyzed
9.0EPSS 0.011
CVE-2022-34255
Adobe Commerce Improper Access Control Privilege escalation
Published 2022-08-16 · Modified
8.8EPSS 0.022
CVE-2022-34254
Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution
Published 2022-08-16 · Modified
8.8EPSS 0.022
CVE-2024-34111
SSRF in service connector
Published 2024-06-13 · Modified
8.8EPSS 0.013
CVE-2022-42344
[CVE-2021-36032] Magento IDOR Leads to Account Takeover
Published 2022-10-20 · Modified
8.8EPSS 0.012
CVE-2023-38218
Incorrect Authorization - Customer account takeover
Published 2023-10-13 · Modified
8.8EPSS 0.008
CVE-2024-45148
Adobe Commerce | Improper Authentication (CWE-287)
Published 2024-10-10 · Analyzed
8.8EPSS 0.007
CVE-2025-24438
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Modified
8.7EPSS 0.008
CVE-2025-24414
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24412
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24413
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24415
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24416
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24410
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-24417
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-02-11 · Analyzed
8.7EPSS 0.007
CVE-2025-49557
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2025-08-12 · Analyzed
8.7EPSS 0.006
CVE-2023-38219
Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping
Published 2023-10-13 · Modified
8.7EPSS 0.006
CVE-2026-47994
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Published 2026-07-14 · Analyzed
8.7EPSS 0.006
1 / 6Next →