PHP package security

Is magento/community-edition vulnerable?

Q: Does magento/community-edition have known vulnerabilities?

Yes. Packagist lists 361 security advisories for magento/community-edition (47 critical, 104 high, 193 medium, 17 low severity). The most recent, reported 2025-10-14, is "Magento allows incorrect authorization". The newest release, 2.4.9, is still inside the affected range of 1 of them.

Q: Which version of magento/community-edition should I run?

The newest stable release is 2.4.9 (published 2026-05-04). The most recent advisory is fixed in 2.4.6-p13, 2.4.7-p8, 2.4.8-p3 and 2.4.9-alpha3, so stay on or above the fixed version for your major version. Run composer update magento/community-edition, then composer audit to confirm nothing else is flagged.

Q: How do I check if my magento/community-edition version is affected?

Run composer show magento/community-edition in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

361 known security advisories for magento/community-edition. The latest was reported on 2025-10-14 and is fixed in 2.4.6-p13, 2.4.7-p8, 2.4.8-p3 and 2.4.9-alpha3. The newest release, 2.4.9, is inside the affected range of 1 of them.

47 critical 104 high 193 medium 17 low

Known advisories: 361
Newest release: 2.4.9
Released: 2026-05-04
Affecting newest release: 1
Last synced: 2026-11-03

Magento 2 (Open Source) · packagist.org/packages/magento/community-edition

Check your version

Run composer show magento/community-edition in your project to see the installed version, then enter it here.

Security advisories for magento/community-edition

Newest first. “Affected” is the Composer version constraint from the advisory; “fixed in” is each version the advisory names as the first safe one on its release line.

Reported	Advisory	Severity	Affected	Fixed in
2025-10-14	Magento allows incorrect authorization GHSA-r355-75hw-r8jf · CVE-2025-54265 · GitHub	medium	=2.4.6 \| =2.4.7 \| =2.4.8 \| <2.4.6-p13 \| >=2.4.7-beta1,<2.4.7-p8 \| >=2.4.8-beta1,<2.4.8-p3 \| >=2.4.9-alpha1,<2.4.9-alpha3	2.4.6-p13, 2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3
2025-10-14	Magento provides incorrect authorization through a security feature bypass GHSA-69x9-xp2j-w8g8 · CVE-2025-54263 · GitHub	high	=2.4.6 \| =2.4.7 \| =2.4.8 \| <2.4.6-p13 \| >=2.4.7-beta1,<2.4.7-p8 \| >=2.4.8-beta1,<2.4.8-p3 \| >=2.4.9-alpha1,<2.4.9-alpha3	2.4.6-p13, 2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3
2025-10-14	Magento vulnerable to stored Cross-Site Scripting (XSS) GHSA-2768-5wmv-cfff · CVE-2025-54264 · GitHub	high	=2.4.6 \| =2.4.7 \| =2.4.8 \| <2.4.6-p13 \| >=2.4.7-beta1,<2.4.7-p8 \| >=2.4.8-beta1,<2.4.8-p3 \| >=2.4.9-alpha1,<2.4.9-alpha3	2.4.6-p13, 2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3
2025-10-14	Magento vulnerable to stored Cross-Site Scripting (XSS) GHSA-pcrx-r49h-x2w5 · CVE-2025-54266 · GitHub	medium	=2.4.6 \| =2.4.7 \| =2.4.8 \| <2.4.6-p13 \| >=2.4.7-beta1,<2.4.7-p8 \| >=2.4.8-beta1,<2.4.8-p3 \| >=2.4.9-alpha1,<2.4.9-alpha3	2.4.6-p13, 2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3
2025-10-14	Magento vulnerable to privilege escalation due to incorrect authorization GHSA-qvwr-p3hj-j6jf · CVE-2025-54267 · GitHub	medium	=2.4.6 \| =2.4.7 \| =2.4.8 \| <2.4.6-p13 \| >=2.4.7-beta1,<2.4.7-p8 \| >=2.4.8-beta1,<2.4.8-p3 \| >=2.4.9-alpha1,<2.4.9-alpha3	2.4.6-p13, 2.4.7-p8, 2.4.8-p3, 2.4.9-alpha3
2025-09-09	Magento Community Edition Improper Input Validation vulnerability GHSA-wh92-6q6g-px7j · CVE-2025-54236 · GitHub	critical	=2.4.9 \| >=2.4.8-beta1,<=2.4.8-p2 \| >=2.4.7-beta1,<=2.4.7-p7 \| =2.4.8 \| =2.4.7 \| >=2.4.9-alpha1,<=2.4.9-alpha2 \| =2.4.5 \| >=2.4.6-p1,<=2.4.6-p12 \| =2.4.6 \| <=2.4.5-p14	not stated
2025-08-12	Magento vulnerable to denial of service GHSA-xgfm-992v-h2hr · CVE-2025-49554 · GitHub	high	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p14 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.7-beta1,<2.4.7-p7 \| >=2.4.8-beta1,<2.4.8-p2 \| >=2.4.9-alpha1,<2.4.9-alpha2	2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2
2025-08-12	Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability GHSA-wcmw-8xpp-rwfj · CVE-2025-49558 · GitHub	medium	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p14 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.7-beta1,<2.4.7-p7 \| >=2.4.8-beta1,<2.4.8-p2 \| >=2.4.9-alpha1,<2.4.9-alpha2	2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2
2025-08-12	Magento vulnerable to path traversal GHSA-h4f4-gv6h-x824 · CVE-2025-49559 · GitHub	medium	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p14 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.7-beta1,<2.4.7-p7 \| >=2.4.8-beta1,<2.4.8-p2 \| >=2.4.9-alpha1,<2.4.9-alpha2	2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2
2025-08-12	Magento Cross-site Scripting vulnerability GHSA-8mq8-c243-2335 · CVE-2025-49557 · GitHub	high	=2.4.8 \| >=2.4.7-p1,<2.4.7-p7 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.5-p1,<2.4.5-p14 \| <2.4.4-p15	2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
2025-08-12	Magento has incorrect authorization issue that leads to arbitrary file system read GHSA-7hrj-3c9x-xv5h · CVE-2025-49556 · GitHub	high	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p14 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.7-beta1,<2.4.7-p7 \| >=2.4.8-beta1,<2.4.8-p2 \| >=2.4.9-alpha1,<2.4.9-alpha2	2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2
2025-08-12	Magento Cross-Site Request Forgery (CSRF) vulnerability GHSA-5777-jj7p-mpqw · CVE-2025-49555 · GitHub	high	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p14 \| >=2.4.6-p1,<2.4.6-p12 \| >=2.4.7-beta1,<2.4.7-p7 \| >=2.4.8-beta1,<2.4.8-p2 \| >=2.4.9-alpha1,<2.4.9-alpha2	2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2
2025-06-26	Magento Authenticated Security feature bypass GHSA-85jx-x9r4-45m2 · CVE-2025-49549 · GitHub	low	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p13 \| >=2.4.6-p1,<2.4.6-p11 \| >=2.4.7-beta1,<2.4.7-p6	2.4.5-p13, 2.4.6-p11, 2.4.7-p6
2025-06-26	Magento Security feature bypass GHSA-8hcx-xvww-6c6h · CVE-2025-49550 · GitHub	medium	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p13 \| >=2.4.6-p1,<2.4.6-p11 \| >=2.4.7-beta1,<2.4.7-p6	2.4.5-p13, 2.4.6-p11, 2.4.7-p6
2025-06-10	Magneto contains stored XSS vulnerability GHSA-j934-vjh5-vf9r · CVE-2025-47110 · GitHub	critical	=2.4.6 \| >=2.4.6-p1,<2.4.6-p11 \| =2.4.5 \| =2.4.8 \| =2.4.7 \| <2.4.5-p13 \| >=2.4.7-beta1,<2.4.7-p6 \| >=2.4.8-beta1,<2.4.8-p1	2.4.5-p13, 2.4.6-p11, 2.4.7-p6, 2.4.8-p1
2025-06-10	Magento Improper Authorization leading to security feature bypass GHSA-r487-9vv5-75gg · CVE-2025-43585 · GitHub	high	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p13 \| >=2.4.6-p1,<2.4.6-p11 \| >=2.4.7-beta1,<2.4.7-p6	2.4.5-p13, 2.4.6-p11, 2.4.7-p6
2025-06-10	Magento Improper Access Control leads to security feature bypass GHSA-g2pj-xmxq-3r9q · CVE-2025-27206 · GitHub	medium	=2.4.8 \| =2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.5-p13 \| >=2.4.6-p1,<2.4.6-p11 \| >=2.4.7-beta1,<2.4.7-p6	2.4.5-p13, 2.4.6-p11, 2.4.7-p6
2025-04-08	Magento Improper Access Control leads to Security feature bypass GHSA-vhcq-4xrm-2cr2 · CVE-2025-27191 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.4 \| =2.4.5 \| >=2.4.8-beta1,<2.4.8-beta2 \| <2.4.4-p13 \| >=2.4.5-p1,<2.4.5-p12 \| >=2.4.6-p1,<2.4.6-p10 \| >=2.4.7-beta1,<2.4.7-p5	2.4.4-p13, 2.4.5-p12, 2.4.6-p10, 2.4.7-p5, 2.4.8-beta2
2025-04-08	Magento Improper Authorization vulnerability GHSA-rr2g-rrjj-xw86 · CVE-2025-27188 · GitHub	medium	>=2.4.8-beta1,<2.4.8 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p5 \| >=2.4.6-p1,<2.4.6-p10 \| >=2.4.5-p1,<2.4.5-p12 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p13	2.4.4-p13, 2.4.5-p12, 2.4.6-p10, 2.4.7-p5, 2.4.8
2025-04-08	Magento does not properly protect credentials GHSA-2r94-wm5v-4prx · CVE-2025-27192 · GitHub	low	=2.4.7 \| =2.4.6 \| =2.4.4 \| =2.4.5 \| >=2.4.8-beta1,<2.4.8-beta2 \| <2.4.4-p13 \| >=2.4.5-p1,<2.4.5-p12 \| >=2.4.6-p1,<2.4.6-p10 \| >=2.4.7-beta1,<2.4.7-p5	2.4.4-p13, 2.4.5-p12, 2.4.6-p10, 2.4.7-p5, 2.4.8-beta2
2025-04-08	Magento Improper Access Control leads to Security feature bypass GHSA-6wq7-cg9h-mj6q · CVE-2025-27190 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.4 \| =2.4.5 \| >=2.4.8-beta1,<2.4.8-beta2 \| <2.4.4-p13 \| >=2.4.5-p1,<2.4.5-p12 \| >=2.4.6-p1,<2.4.6-p10 \| >=2.4.7-beta1,<2.4.7-p5	2.4.4-p13, 2.4.5-p12, 2.4.6-p10, 2.4.7-p5, 2.4.8-beta2
2025-02-11	Improper Authorization vulnerability in Magento and Adobe Commerce GHSA-fppq-f2m6-xv5c · CVE-2025-24434 · GitHub	critical	<2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4 \| >=2.4.8-beta1,<2.4.8-beta2	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4, 2.4.8-beta2
2025-02-11	Magento stored Cross-Site Scripting (XSS) vulnerability GHSA-mm87-rrqx-94cr · CVE-2025-24428 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability GHSA-7jmr-43qj-pw47 · CVE-2025-24432 · GitHub	low	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-469f-wf4f-3jjv · CVE-2025-24437 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-ghpr-6qhr-rpp8 · CVE-2025-24436 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Business Logic Error vulnerability GHSA-6ff8-jrfg-43hh · CVE-2025-24425 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-656q-fx2w-8ccv · CVE-2025-24429 · GitHub	low	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-82p4-55gj-956p · CVE-2025-24435 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p11 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-v3hq-g424-5mgg · CVE-2025-24427 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability GHSA-6w27-c66f-gvhq · CVE-2025-24430 · GitHub	low	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento stored Cross-Site Scripting (XSS) vulnerability GHSA-8884-7rm9-mrx4 · CVE-2025-24438 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Information Exposure vulnerability GHSA-3cfg-w257-cgf8 · CVE-2025-24408 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-g3j6-9753-8mp2 · CVE-2025-24417 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Adobe Commerce Improper Authorization vulnerability GHSA-vw47-79jv-3598 · CVE-2025-24409 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-gc27-rvvm-q77r · CVE-2025-24415 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-fhw6-3mj5-w9gv · CVE-2025-24414 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-m4rg-mpp2-97px · CVE-2025-24412 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-539v-w87w-w62c · CVE-2025-24424 · GitHub	medium	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-rjjw-g6hw-7pc9 · CVE-2025-24416 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-gjxp-46rq-wg4q · CVE-2025-24410 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Stored Cross-Site Scripting (XSS) Vulnerability GHSA-xwgx-8v72-4j5j · CVE-2025-24413 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Incorrect Authorization vulnerability GHSA-v6r2-425c-hfrr · CVE-2025-24421 · GitHub	medium	=2.4.8-beta1 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Magento Improper Access Control vulnerability GHSA-36hw-x3cc-m258 · CVE-2025-24411 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2025-02-11	Adobe Commerce Path Traversal GHSA-954p-ff72-327w · CVE-2025-24406 · GitHub	high	=2.4.8-beta1 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p12 \| >=2.4.5-p1,<2.4.5-p11 \| >=2.4.6-p1,<2.4.6-p9 \| >=2.4.7-beta1,<2.4.7-p4	2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-w7rg-7wq2-pjrw · CVE-2024-45149 · GitHub	low	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Authorization vulnerability GHSA-xc5p-773w-m3pm · CVE-2024-45131 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-8pxg-gcp4-57ww · CVE-2024-45135 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Information Exposure vulnerability GHSA-j3mh-wx5f-2vhg · CVE-2024-45133 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Authorization vulnerability GHSA-5f64-ppmg-cvvm · CVE-2024-45132 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Information Exposure vulnerability GHSA-4f89-5cwm-rm5g · CVE-2024-45134 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Cross-Site Scripting (XSS) vulnerability GHSA-873m-72g6-853g · CVE-2024-45116 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Incorrect Authorization vulnerability GHSA-xg36-8c2v-jpxh · CVE-2024-45125 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-46fm-x82m-5f74 · CVE-2024-45122 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source stored Cross-Site Scripting (XSS) vulnerability GHSA-c89g-gq5r-2xw2 · CVE-2024-45127 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability GHSA-88x2-cq34-5fwc · CVE-2024-45123 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-cg52-68fv-94qq · CVE-2024-45118 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Authorization vulnerability GHSA-qpp7-742q-58j3 · CVE-2024-45128 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-w3p2-pc3h-69wv · CVE-2024-45124 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-m58h-998x-66f3 · CVE-2024-45129 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Server-Side Request Forgery (SSRF) vulnerability GHSA-g9fm-wc6h-pvgj · CVE-2024-45119 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-2qhq-fw98-h6wg · CVE-2024-45121 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability GHSA-47jp-46c9-25vf · CVE-2024-45120 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Access Control vulnerability GHSA-v3v6-jfvw-m576 · CVE-2024-45130 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-10-10	Magento Open Source Improper Input Validation vulnerability GHSA-3fr3-gcqh-3m2g · CVE-2024-45117 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| <2.4.4-p11 \| >=2.4.5-p1,<2.4.5-p10 \| >=2.4.6-p1,<2.4.6-p8 \| >=2.4.7-beta1,<2.4.7-p3	2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3
2024-08-14	Magento Improper Authorization leads to Security feature bypass GHSA-4xgg-rw35-7mv5 · CVE-2024-39416 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization vulnerability GHSA-cjm6-8mw8-2f8c · CVE-2024-39407 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability GHSA-4323-f82v-f6jr · CVE-2024-39410 · GitHub	medium	=2.4.4 \| <2.4.4-p10 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p9 \| =2.4.6 \| >=2.4.6-p1,<2.4.6-p7 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Open Source Improper Authorization vulnerability GHSA-7472-vw39-g2j3 · CVE-2024-39412 · GitHub	medium	=2.4.4 \| <2.4.4-p10 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p9 \| =2.4.6 \| >=2.4.6-p1,<2.4.6-p7 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization vulnerability GHSA-gvgf-pvh5-vjh4 · CVE-2024-39418 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Open Source Cross-Site Request Forgery vulnerability GHSA-4cj6-f32v-6hgx · CVE-2024-39408 · GitHub	medium	=2.4.4 \| <2.4.4-p10 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p9 \| =2.4.6 \| >=2.4.6-p1,<2.4.6-p7 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Open Source Path Traversal vulnerability GHSA-6pxh-2557-5cj5 · CVE-2024-39406 · GitHub	medium	=2.4.4 \| <2.4.4-p10 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p9 \| =2.4.6 \| >=2.4.6-p1,<2.4.6-p7 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization Leading to Security feature bypass GHSA-gj93-84g5-mcjq · CVE-2024-39415 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability GHSA-rf4q-m23c-7q8r · CVE-2024-39409 · GitHub	medium	=2.4.4 \| <2.4.4-p10 \| =2.4.5 \| >=2.4.5-p1,<2.4.5-p9 \| =2.4.6 \| >=2.4.6-p1,<2.4.6-p7 \| =2.4.7 \| >=2.4.7-p1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Access Control Leads to Privilege escalation GHSA-74w7-cr4v-wf2v · CVE-2024-39419 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization leads to security feature bypass GHSA-qm77-mqf3-fmhq · CVE-2024-39411 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization vulnerability GHSA-8w5f-8992-g86j · CVE-2024-39413 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Access Control Leads to Privilege escalation GHSA-x6f9-hv9r-fgq4 · CVE-2024-39414 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization leads to Security feature bypass GHSA-4xmj-f664-hv98 · CVE-2024-39417 · GitHub	medium	=2.4.7 \| =2.4.6 \| =2.4.5 \| =2.4.4 \| <2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento OS Command ('OS Command Injection') vulnerability GHSA-8frp-pxq2-3gpq · CVE-2024-39401 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento does not properly restrict excessive authentication attempts GHSA-q628-54wg-4r5q · CVE-2024-39398 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Path Traversal vulnerability GHSA-7r99-8wqp-h7pc · CVE-2024-39399 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization vulnerability GHSA-5g9f-7gqc-8hj4 · CVE-2024-39405 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento DOM-based Cross-Site Scripting (XSS) vulnerability GHSA-52fg-wjxm-pp44 · CVE-2024-39400 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Improper Authorization vulnerability GHSA-qrh3-vxjg-h9h6 · CVE-2024-39404 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento Stored Cross-Site Scripting (XSS) vulnerability GHSA-mmp7-8cg4-9wrg · CVE-2024-39403 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-08-14	Magento OS Command ('OS Command Injection') vulnerability GHSA-2ff6-837j-hg5x · CVE-2024-39402 · GitHub	high	=2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| >=2.4.4-p1,<2.4.4-p10 \| >=2.4.5-p1,<2.4.5-p9 \| >=2.4.6-p1,<2.4.6-p7 \| >=2.4.7-beta1,<2.4.7-p2	2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
2024-06-13	Magento Open Source Server-Side Request Forgery (SSRF) vulnerability GHSA-jmqp-r3gg-6jh3 · CVE-2024-34111 · GitHub	medium	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source Improper Authorization vulnerability GHSA-wwj3-573j-rvvm · CVE-2024-34104 · GitHub	high	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source Improper Access Control vulnerability GHSA-r7cm-g469-wm4g · CVE-2024-34107 · GitHub	medium	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source Incorrect Authorization vulnerability GHSA-p6h9-gx5g-wg64 · CVE-2024-34106 · GitHub	medium	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source Cross-Site Scripting (XSS) vulnerability GHSA-5632-wq7m-gfq9 · CVE-2024-34105 · GitHub	medium	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability GHSA-m8cj-3v68-3cxj · CVE-2024-34102 · GitHub	critical	=2.4.7 \| =2.4.6 \| =2.4.5 \| <2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-06-13	Magento Open Source Improper Authentication vulnerability GHSA-f7q4-9gwv-6774 · CVE-2024-34103 · GitHub	critical	<2.4.4-p9 \| >=2.4.5-p1,<2.4.5-p8 \| >=2.4.6-p1,<2.4.6-p6 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7	2.4.4-p9, 2.4.5-p8, 2.4.6-p6
2024-05-15	Magento RCE,XSS and other vulnerabilities GHSA-8j7c-682x-r9f2 · GitHub	critical	>=2.2,<2.2.7 \| >=2.1,<2.1.16	2.1.16, 2.2.7
2024-05-15	Magento Cross-Site Scripting (XSS) vulnerability GHSA-mcfc-67vm-j568 · GitHub	medium	>=2.2,<2.2.6 \| >=2.1,<2.1.15	2.1.15, 2.2.6
2024-05-15	Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities GHSA-5gmh-85x8-5cx7 · GitHub	critical	>=2.2,<2.2.5 \| >=2.1,<2.1.14	2.1.14, 2.2.5
2024-05-15	Magento Open Source Security Advisory: Patch SUPEE-10975 GHSA-cv25-3pxr-4q7x · GitHub	critical	>=1.9.0.0,<1.14.4.0	1.14.4.0
2024-05-15	Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability GHSA-26hq-7286-mg8f · GitHub	critical	>=1.9.0.0,<1.14.3.2	1.14.3.2
2024-05-15	Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities GHSA-6wm4-3rjj-c8xx · GitHub	critical	>=1.5.0.0,<1.9.4.0	1.9.4.0
2024-05-15	Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities GHSA-prpf-cj87-hwvr · GitHub	critical	<1.9.3.9	1.9.3.9
2024-04-10	Magento Open Source allows Cross-Site Scripting (XSS) GHSA-59vf-hjxc-f9c5 · CVE-2024-20759 · GitHub	medium	>=2.4.4-p1,<2.4.4-p8 \| >=2.4.5-p1,<2.4.5-p7 \| >=2.4.6-p1,<2.4.6-p5 \| >=2.4.7-beta1,<=2.4.7-beta3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p8, 2.4.5-p7, 2.4.6-p5
2024-04-10	Magento Open Source allows Improper Input Validation GHSA-wh4m-6rh3-p4rq · CVE-2024-20758 · GitHub	high	>=2.4.4-p1,<2.4.4-p8 \| >=2.4.5-p1,<2.4.5-p7 \| >=2.4.6-p1,<2.4.6-p5 \| >=2.4.7-beta1,<=2.4.7-beta3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p8, 2.4.5-p7, 2.4.6-p5
2024-02-15	Magento Open Source allows Uncontrolled Resource Consumption GHSA-c9h9-h5gf-885r · CVE-2024-20716 · GitHub	medium	>=2.4.4-p1,<2.4.4-p7 \| >=2.4.5-p1,<2.4.5-p6 \| >=2.4.6-p1,<2.4.6-p4 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p7, 2.4.5-p6, 2.4.6-p4
2024-02-15	Magento Open Source allows Cross-Site Request Forgery (CSRF) GHSA-hqgj-4396-hmxv · CVE-2024-20718 · GitHub	medium	>=2.4.4-p1,<2.4.4-p7 \| >=2.4.5-p1,<2.4.5-p6 \| >=2.4.6-p1,<2.4.6-p4 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p7, 2.4.5-p6, 2.4.6-p4
2024-02-15	Magento Open Source allows Cross-Site Scripting (XSS) GHSA-264g-f7v8-q5qq · CVE-2024-20719 · GitHub	high	>=2.4.4-p1,<2.4.4-p7 \| >=2.4.5-p1,<2.4.5-p6 \| >=2.4.6-p1,<2.4.6-p4 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p7, 2.4.5-p6, 2.4.6-p4
2024-02-15	Magento Open Source allows OS Command Injection GHSA-525f-pvj5-vqmq · CVE-2024-20720 · GitHub	high	>=2.4.4-p1,<2.4.4-p7 \| >=2.4.5-p1,<2.4.5-p6 \| >=2.4.6-p1,<2.4.6-p4 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p7, 2.4.5-p6, 2.4.6-p4
2023-10-13	Magento Open Source allows Uncontrolled Resource Consumption GHSA-7pfc-834q-h497 · CVE-2023-38251 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows SQL Injection GHSA-rq36-9f5f-2gw7 · CVE-2023-38249 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows SQL Injection GHSA-h3g9-cwr6-hphx · CVE-2023-38250 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows Incorrect Authorization GHSA-rpc7-gf58-v3x2 · CVE-2023-38218 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows Improper Authorization GHSA-grc6-r6f8-xj7c · CVE-2023-38220 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows SQL Injection GHSA-ggr8-3hwx-4f2m · CVE-2023-38221 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows Cross-Site Scripting (XSS) GHSA-3j7w-jp46-9752 · CVE-2023-38219 · GitHub	low	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source allows Server-Side Request Forgery (SSRF) GHSA-8jxc-5f94-22vh · CVE-2023-26366 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-10-13	Magento Open Source has Improper Input Validation Vulnerability GHSA-9mx6-4gg4-85xj · CVE-2023-26367 · GitHub	medium	>=2.4.4-p1,<2.4.4-p6 \| >=2.4.5-p1,<2.4.5-p5 \| >=2.4.6-p1,<2.4.6-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6 \| =2.4.7 \| =2.4.7-beta1	2.4.4-p6, 2.4.5-p5, 2.4.6-p3
2023-09-18	Magento Open Source affected by Improper Input Validation GHSA-5xmp-7wg5-x68q · CVE-2022-24093 · GitHub	medium	>=2.3.7-p1,<2.3.7-p3 \| =2.4.3-p1 \| =2.3.7 \| =2.4.3	2.3.7-p3
2023-09-06	Magento improper access control vulnerability within Magento's Media Gallery Upload workflow GHSA-wqr6-wv6c-p8fx · CVE-2021-36036 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2023-09-06	Magento XML Injection vulnerability in the Widgets Update Layout GHSA-8cjg-f53m-8m9q · CVE-2021-36023 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2023-09-06	Magento affected by remote code execution vulnerability in the CMS page scheduled update feature GHSA-4g27-q2w9-m8m8 · CVE-2021-36021 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2023-08-09	Magento Open Source allows Incorrect Authorization GHSA-3vg2-v639-6ch9 · CVE-2023-38209 · GitHub	medium	>=2.4.4-p1,<2.4.4-p5 \| >=2.4.5-p1,<2.4.5-p4 \| =2.4.6-p1 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p5, 2.4.5-p4
2023-08-09	Magento Open Source allows Improper Neutralization of Special Elements Used GHSA-mxc9-g6m4-2v35 · CVE-2023-38208 · GitHub	high	>=2.4.4-p1,<2.4.4-p5 \| >=2.4.5-p1,<2.4.5-p4 \| =2.4.6-p1 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p5, 2.4.5-p4
2023-08-09	Magento Open Source allows XML Injection GHSA-rpv2-g4pc-wp72 · CVE-2023-38207 · GitHub	low	>=2.4.4-p1,<2.4.4-p5 \| >=2.4.5-p1,<2.4.5-p4 \| =2.4.6-p1 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p5, 2.4.5-p4
2023-07-06	Magento Open Source allows Cross-Site Scripting (XSS) GHSA-fxcr-gvcw-hmqm · CVE-2023-22249 · GitHub	low	=2.4.5-p1 \| >=2.4.4-p1,<=2.4.4-p2 \| =2.4.5 \| =2.4.4	not stated
2023-06-15	Magento Open Source allows Server-Side Request Forgery (SSRF) GHSA-5f79-vhr4-vw2r · CVE-2023-29291 · GitHub	medium	=2.4.4 \| =2.4.5 \| >=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Incorrect Authorization GHSA-f989-3fp9-q3r2 · CVE-2023-29288 · GitHub	medium	=2.4.5 \| =2.4.4 \| >=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Incorrect Authorization GHSA-qw5m-vmp3-f553 · CVE-2023-29290 · GitHub	medium	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Improper Neutralization of Special Elements Used GHSA-gfmm-ww6f-5mm5 · CVE-2023-29297 · GitHub	high	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source has Business Logic Errors Vulnerability GHSA-28vp-39rf-3q2j · CVE-2023-29294 · GitHub	low	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source affected by Improper Input Validation GHSA-66c9-xrwj-9xv6 · CVE-2023-29293 · GitHub	low	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Server-Side Request Forgery (SSRF) GHSA-4588-7x48-jrgj · CVE-2023-29292 · GitHub	medium	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows XML Injection GHSA-wh42-8r2w-873x · CVE-2023-29289 · GitHub	medium	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Incorrect Authorization GHSA-354h-fpmq-68v7 · CVE-2023-29295 · GitHub	low	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source affected by Improper Input Validation GHSA-5jfg-phx7-7fxg · CVE-2023-22248 · GitHub	medium	=2.4.5 \| =2.4.4 \| >=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Information Exposure GHSA-85m4-g9vq-xpxj · CVE-2023-29287 · GitHub	medium	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-06-15	Magento Open Source allows Incorrect Authorization GHSA-3qr4-w96f-672v · CVE-2023-29296 · GitHub	low	>=2.4.4-p1,<2.4.4-p4 \| >=2.4.5-p1,<2.4.5-p3 \| =2.4.4 \| =2.4.5 \| =2.4.6	2.4.4-p4, 2.4.5-p3
2023-03-27	Magento Open Source allows Improper Access Control GHSA-4h7p-4vq8-g2gh · CVE-2023-22250 · GitHub	medium	=2.4.5-p1 \| =2.4.5 \| =2.4.4 \| >=2.4.4-p1,<2.4.4-p3	2.4.4-p3
2023-03-27	Magento Open Source allows Incorrect Authorization GHSA-2wm7-mmgc-qxr3 · CVE-2023-22251 · GitHub	medium	=2.4.4 \| =2.4.5 \| =2.4.5-p1 \| >=2.4.4-p1,<2.4.4-p3	2.4.4-p3
2023-03-27	Magento Open Source allows XML Injection GHSA-2444-8gj8-6fmx · CVE-2023-22247 · GitHub	high	=2.4.4 \| >=2.4.4-p1,<2.4.4-p3 \| =2.4.5 \| =2.4.5-p1	2.4.4-p3
2022-10-20	Magento Improper input validation vulnerability GHSA-297f-r9w7-w492 · CVE-2022-42344 · GitHub	high	=2.4.4 \| >=2.4.0,<2.4.3-p3 \| <2.3.7-p4	2.3.7-p4, 2.4.3-p3
2022-10-15	Magento Open Source allows Improper Access Control GHSA-5fxx-jwjm-x9hj · CVE-2022-35689 · GitHub	medium	=2.4.3 \| >=2.4.3-p1,<=2.4.3-p3 \| =2.4.5 \| =2.4.4 \| =2.4.4-p1	not stated
2022-10-15	Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) GHSA-4vj2-426r-jm3g · CVE-2022-35698 · GitHub	high	=2.4.3 \| >=2.4.3-p1,<=2.4.3-p3 \| =2.4.5 \| =2.4.4 \| =2.4.4-p1	not stated
2022-08-20	Magento Open Source has Improper Access Control vulnerability GHSA-gm4m-9rm8-7rxj · CVE-2022-35692 · GitHub	medium	=2.4.3 \| =2.4.4 \| =2.3.7 \| >=2.3.7-p1,<2.3.7-p4 \| >=2.4.3-p1,<2.4.3-p3	2.3.7-p4, 2.4.3-p3
2022-08-17	Magento Path Traversal vulnerability GHSA-fx9g-g9q6-x3jx · CVE-2022-34254 · GitHub	high	=2.4.4 \| >=2.4.0,<2.4.3-p3 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3
2022-08-17	Magento stored Cross-Site Scripting (XSS) vulnerability GHSA-rg7p-wmgj-f374 · CVE-2022-34257 · GitHub	medium	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-08-17	Magento Improper Access Control vulnerability GHSA-x95x-f4g9-mm85 · CVE-2022-34255 · GitHub	high	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-08-17	Magento Improper Authorization vulnerability GHSA-r7mm-grf3-5fjv · CVE-2022-34256 · GitHub	high	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-08-17	Magento stored Cross-Site Scripting (XSS) vulnerability GHSA-5m55-g8pv-x8ww · CVE-2022-34258 · GitHub	medium	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-08-17	Magento Improper Access Control vulnerability GHSA-9wjf-94h3-r4rh · CVE-2022-34259 · GitHub	medium	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| >=2.3.0,<2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-08-17	Magento XML Injection vulnerability in the Widgets Module GHSA-cj7w-pm77-hvg6 · CVE-2022-34253 · GitHub	critical	>=2.4.0,<2.4.3-p3 \| >=2.4.4,<2.4.5 \| <2.3.7-p4	2.3.7-p4, 2.4.3-p3, 2.4.5
2022-05-24	Magento stored cross-site scripting vulnerability GHSA-x2v2-2jhp-c5hv · CVE-2021-36027 · GitHub	medium	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento stored cross-site scripting vulnerability in the customer address upload feature GHSA-8gfq-m4cf-w975 · CVE-2021-36026 · GitHub	medium	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento remote code execution vulnerability GHSA-4v2q-hjx3-c4vr · CVE-2019-8154 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento Broken authentication and session managememt GHSA-8mwx-wpp4-5xh4 · CVE-2019-8149 · GitHub	critical	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition SQLi Vulnerability GHSA-4j6w-9rf8-hg7r · CVE-2019-7139 · GitHub	critical	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Open Source allows Cross-Site Request Forgery (CSRF) GHSA-94wq-87g6-8h77 · CVE-2021-39864 · GitHub	medium	=2.4.2 \| <=2.3.7-p1 \| =2.4.3 \| >=2.4.2-p1,<=2.4.2-p2	not stated
2022-05-24	Magento Information Disclosure vulnerability GHSA-w942-fw92-mqm2 · CVE-2021-28566 · GitHub	low	>=2.3.0,<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento Improper Authorization vulnerability in the customers module GHSA-cc3w-r3w8-hfh7 · CVE-2021-28567 · GitHub	medium	<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento XML Injection vulnerability in the 'City' field GHSA-xvpx-6hh8-7h72 · CVE-2021-36020 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento affected by a business logic error in the placeOrder graphql mutation GHSA-3f97-7pgv-gmgr · CVE-2021-36012 · GitHub	medium	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento XML Injection vulnerability in the Widgets Update Layout GHSA-3x9x-vhqj-cv27 · CVE-2021-36022 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento is affected by an improper input validation vulnerability while saving a customer's details GHSA-gvfx-9m9v-h839 · CVE-2021-36025 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento is affected by an improper input validation vulnerability GHSA-5vw8-r55w-f4q4 · CVE-2021-36032 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento Path Traversal vulnerability via the `theme[preview_image]` parameter GHSA-7w95-qwhh-q9p3 · CVE-2021-36031 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento has an XML Injection vulnerability GHSA-5pjj-7fq8-9gpf · CVE-2021-36028 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento XML Injection vulnerability in the Widgets Module GHSA-p746-qw73-qmmx · CVE-2021-36033 · GitHub	critical	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento allows attackers to alter the price of items GHSA-rhff-65hp-55rw · CVE-2021-36030 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento is affected by an os command injection via the Data collection endpoint GHSA-qmq6-jpvg-j547 · CVE-2021-36024 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento improper authorization vulnerability GHSA-m8wx-whpp-q283 · CVE-2021-36029 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento affected by remote code execution via a file upload GHSA-j46h-qjjv-cxfj · CVE-2021-36034 · GitHub	high	<2.3.7-p1 \| =2.3.7 \| >=2.4.2-p1,<2.4.2-p2 \| =2.4.2	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento vulnerable to file upload attack GHSA-mx5m-j5xr-jg8c · CVE-2021-36041 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento discloses sensitive information via the Multishipping Module GHSA-wgpr-9675-8r67 · CVE-2021-36038 · GitHub	medium	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento is affected by an improper authorization vulnerability GHSA-vrq2-w7r7-3fp2 · CVE-2021-36037 · GitHub	medium	<2.3.7-p1 \| =2.3.7 \| >=2.4.2-p1,<2.4.2-p2 \| =2.4.2	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension GHSA-36xq-7w8w-xp68 · CVE-2021-36043 · GitHub	high	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento discloses sensitive information GHSA-3g7m-g8qm-x6j5 · CVE-2021-36039 · GitHub	medium	=2.4.2 \| >=2.4.2-p1,<2.4.2-p2 \| =2.3.7 \| <2.3.7-p1	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento executes code via the API File Option Upload Extension GHSA-6cwv-wj7v-73xp · CVE-2021-36042 · GitHub	critical	<2.3.7-p1 \| =2.3.7 \| >=2.4.2-p1,<2.4.2-p2 \| =2.4.2	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento has a file extension restrictions bypass GHSA-2pq5-gpqf-g4r3 · CVE-2021-36040 · GitHub	critical	<2.3.7-p1 \| =2.3.7 \| >=2.4.2-p1,<2.4.2-p2 \| =2.4.2	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento affected by a server-side denial-of-service using a GraphQL field GHSA-wr57-3h2f-3q95 · CVE-2021-36044 · GitHub	high	<2.3.7-p1 \| =2.3.7 \| >=2.4.2-p1,<2.4.2-p2 \| =2.4.2	2.3.7-p1, 2.4.2-p2
2022-05-24	Magento Unauthorized access to restricted resources GHSA-q9xx-4689-gvv5 · CVE-2021-28563 · GitHub	medium	<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats GHSA-7gh6-f4jh-3crq · CVE-2021-28583 · GitHub	high	<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies GHSA-39ch-rg26-gmq5 · CVE-2021-28556 · GitHub	medium	<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento Path Traversal vulnerability GHSA-7gpv-xrjr-f5h4 · CVE-2021-28584 · GitHub	medium	<2.3.7 \| >=2.4.0,<2.4.2-p1	2.3.7, 2.4.2-p1
2022-05-24	Magento Improper input validation vulnerability GHSA-c38m-9668-6j2w · CVE-2021-28585 · GitHub	medium	>=2.4.0,<2.4.2-p1 \| <2.3.7	2.3.7, 2.4.2-p1
2022-05-24	Magento Insufficient Session Expiration GHSA-4h3p-63x6-vwg2 · CVE-2021-21031 · GitHub	medium	<2.3.6 \| >=2.4.0,<2.4.1-p1	2.3.6, 2.4.1-p1
2022-05-24	Magento Insufficient Session Expiration GHSA-4jfq-f8hc-775q · CVE-2021-21032 · GitHub	medium	<2.3.6 \| >=2.4.0,<2.4.1-p1	2.3.6, 2.4.1-p1
2022-05-24	Magento Insecure Direct Object Reference (IDOR) in the product module GHSA-8pfq-g48p-x7w8 · CVE-2021-21022 · GitHub	medium	>=2.4.0,<2.4.1-p1 \| <2.3.6-p1	2.3.6-p1, 2.4.1-p1
2022-05-24	Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API GHSA-h4xc-577p-hgj9 · CVE-2021-21027 · GitHub	medium	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento Reflected Cross-site Scripting vulnerability via 'file' parameter GHSA-jwxh-wj79-ccm6 · CVE-2021-21029 · GitHub	medium	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento improper authorization vulnerability in the integrations module GHSA-crjc-2v9m-8w7r · CVE-2021-21026 · GitHub	medium	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento stored cross-site scripting vulnerability in the admin console GHSA-h5rm-m772-6qcx · CVE-2021-21023 · GitHub	medium	>=2.4.0,<2.4.1-p1 \| <2.3.6	2.3.6, 2.4.1-p1
2022-05-24	Magento stored cross-site scripting (XSS) in the customer address upload feature GHSA-6988-g89m-27vf · CVE-2021-21030 · GitHub	high	>=2.4.0,<2.4.1-p1 \| <2.3.6	2.3.6, 2.4.1-p1
2022-05-24	Magento XML injection in the Widgets module GHSA-mw95-gmw4-883p · CVE-2021-21019 · GitHub	critical	>=2.4.0,<2.4.1-p1 \| <2.3.6-p1	2.3.6-p1, 2.4.1-p1
2022-05-24	Magento Blind SQL Injection in the Search module GHSA-rj4f-cp4v-hvcv · CVE-2021-21024 · GitHub	critical	>=2.4.0,<2.4.1-p1 \| <2.3.6-p1	2.3.6-p1, 2.4.1-p1
2022-05-24	Magento vulnerable to a file upload restriction bypass GHSA-269w-pqc7-68q9 · CVE-2021-21014 · GitHub	critical	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento Improper Access Control GHSA-2j6v-829g-885q · CVE-2021-21020 · GitHub	medium	>=2.4.0,<2.4.1-p1 \| <2.3.6	2.3.6, 2.4.1-p1
2022-05-24	Magento XPath Injection GHSA-h437-qjj9-vmq4 · CVE-2021-21025 · GitHub	critical	>=2.4.0,<2.4.1-p1 \| <2.3.6-p1	2.3.6-p1, 2.4.1-p1
2022-05-24	Magento OS Command Injection GHSA-rv48-v862-mp92 · CVE-2021-21018 · GitHub	critical	>=2.4.0,<2.4.1-p1 \| <2.3.6	2.3.6, 2.4.1-p1
2022-05-24	Magento OS command injection via the customer attribute save controller GHSA-w2p4-2c8c-2g7h · CVE-2021-21015 · GitHub	high	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento OS command injection via the WebAPI GHSA-792f-c8mp-2cr5 · CVE-2021-21016 · GitHub	critical	>=2.4.0,<2.4.2 \| <2.3.6-p1	2.3.6-p1, 2.4.2
2022-05-24	Magento 2 Community Edition RCE via Unsafe File Upload GHSA-7pxg-6p87-8c9v · CVE-2020-24407 · GitHub	critical	<=2.4.0	not stated
2022-05-24	Magento information disclosure vulnerability GHSA-mr8q-7f5j-wc79 · CVE-2020-24406 · GitHub	low	=2.4.0 \| <2.3.6	2.3.6
2022-05-24	Magento incorrect permissions vulnerability in the Inventory module GHSA-p7m7-j8jv-393q · CVE-2020-24405 · GitHub	medium	>=2.4.0,<2.4.1 \| <=2.3.5-p2	2.4.1
2022-05-24	Magento 2 Community Edition vulnerable to Improper Authorization GHSA-rwf7-652f-76mv · CVE-2020-24404 · GitHub	low	=2.4.0 \| <2.3.6	2.3.6
2022-05-24	Magento incorrect user permissions vulnerability within the Inventory component GHSA-39rw-4m66-82gf · CVE-2020-24403 · GitHub	low	=2.4.0 \| <2.3.6	2.3.6
2022-05-24	Magento 2 Community Edition Incorrect Authorization GHSA-f2g3-3c6q-4478 · CVE-2020-24401 · GitHub	medium	<=2.4.0	not stated
2022-05-24	Magento SQL Injection vulnerability GHSA-pf6w-3pfw-fxvw · CVE-2020-24400 · GitHub	high	=2.4.0 \| <2.3.6	2.3.6
2022-05-24	Magento incorrect permissions vulnerability in the Integrations component GHSA-hvf5-4jr9-fghh · CVE-2020-24402 · GitHub	medium	=2.4.0 \| <2.3.6	2.3.6
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-jxjc-6xmh-h7mg · CVE-2020-24408 · GitHub	medium	<=2.4.0	not stated
2022-05-24	Magento observable timing discrepancy vulnerability GHSA-xgp9-j48h-jjf9 · CVE-2020-9690 · GitHub	medium	<2.3.5-p2	2.3.5-p2
2022-05-24	Magento security mitigation bypass vulnerability GHSA-vqg7-8v6x-54rq · CVE-2020-9692 · GitHub	medium	<2.3.5-p2	2.3.5-p2
2022-05-24	Magento DOM-based Cross-site scripting vulnerability GHSA-g7pc-799q-743f · CVE-2020-9691 · GitHub	critical	<2.3.5-p2	2.3.5-p2
2022-05-24	Magento path traversal vulnerability GHSA-fr6f-xmfx-rrpq · CVE-2020-9689 · GitHub	medium	<2.3.5-p2	2.3.5-p2
2022-05-24	Magento business logic error vulnerability GHSA-5j4w-v87m-8r65 · CVE-2020-9630 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento security mitigation bypass vulnerability GHSA-6w29-x5j4-qhrw · CVE-2020-9632 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento security mitigation bypass vulnerability GHSA-gffx-9f36-r8wp · CVE-2020-9631 · GitHub	critical	<=2.2.11 \| >=2.3.0,<2.3.4-p2	2.3.4-p2
2022-05-24	Magento defense-in-depth security mitigation vulnerability GHSA-w7rh-9w5v-rwqj · CVE-2020-9591 · GitHub	high	<=2.2.11 \| >=2.3.0,<2.3.4-p2	2.3.4-p2
2022-05-24	Magento authorization bypass vulnerability GHSA-8wm7-h2qh-ff4c · CVE-2020-9587 · GitHub	high	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento Signature verification bypass GHSA-j2r4-2cr6-h3r3 · CVE-2020-9588 · GitHub	high	<2.3.4-p2	2.3.4-p2
2022-05-24	Magento command injection vulnerability GHSA-c3m4-hxv9-4mxj · CVE-2020-9582 · GitHub	critical	<2.2.12 \| >=2.3.0,<2.3.4-p2	2.2.12, 2.3.4-p2
2022-05-24	Magento Defense-in-depth security mitigation vulnerability GHSA-55gv-hfg3-hwjq · CVE-2020-9585 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento command injection vulnerability GHSA-c55h-7q4j-g6rq · CVE-2020-9583 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento Stored cross-site scripting GHSA-45h4-6gcj-6hwv · CVE-2020-9584 · GitHub	medium	<2.2.12 \| >=2.3.0,<2.3.4-p2	2.2.12, 2.3.4-p2
2022-05-24	Magento Security mitigation bypass vulnerability GHSA-j2jp-58gv-g2pg · CVE-2020-9580 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento command injection vulnerability GHSA-724x-gqhv-9c5x · CVE-2020-9578 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento stored cross-site scripting vulnerability GHSA-689w-2f93-2x67 · CVE-2020-9577 · GitHub	medium	<2.3.4-p2	2.3.4-p2
2022-05-24	Magento command injection vulnerability GHSA-4f7x-gjqc-qqpg · CVE-2020-9576 · GitHub	critical	<2.2.12 \| >=2.3.0,<2.3.4-p2	2.2.12, 2.3.4-p2
2022-05-24	Magento Security mitigation bypass vulnerability GHSA-vrp3-wc28-qg2h · CVE-2020-9579 · GitHub	critical	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento stored cross-site scripting vulnerability GHSA-2w2x-7qgj-4x78 · CVE-2020-9581 · GitHub	medium	>=2.3.0,<2.3.4-p2 \| <=2.2.11	2.3.4-p2
2022-05-24	Magento sql injection vulnerability GHSA-rr59-pjwj-6grj · CVE-2020-3719 · GitHub	high	<=2.2.10 \| >=2.3.0,<=2.3.3	not stated
2022-05-24	Magento deserialization vulnerability GHSA-9wc9-498w-h8xv · CVE-2020-3716 · GitHub	critical	>=2.3.0,<2.3.4 \| >=2.2.0,<2.2.11	2.2.11, 2.3.4
2022-05-24	Magento stored cross-site scripting vulnerability GHSA-p5q3-xg47-653m · CVE-2020-3758 · GitHub	medium	<=2.2.10 \| >=2.3.0,<=2.3.3	not stated
2022-05-24	Magento security bypass vulnerability GHSA-x9p7-vgp2-9pq2 · CVE-2020-3718 · GitHub	critical	<=2.2.10 \| >=2.3.0,<=2.3.3	not stated
2022-05-24	Magento stored cross-site scripting vulnerability GHSA-mgg3-v948-2vgr · CVE-2020-3715 · GitHub	medium	<=2.2.10 \| >=2.3.0,<=2.3.3	not stated
2022-05-24	Magento Path Traversal GHSA-874g-pxqp-frqp · CVE-2020-3717 · GitHub	medium	>=2.3.0,<2.3.4 \| >=2.2.0,<2.2.11	2.2.11, 2.3.4
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-6vc8-3xf2-qrxx · CVE-2019-8232 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento Server-Side Request Forgery (SSRF) GHSA-f73h-224c-62qr · CVE-2019-8151 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-p783-gj6m-9r88 · CVE-2019-8150 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition SSRF vulnerability GHSA-775w-gx3f-4j4f · CVE-2019-8156 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition XML Injection GHSA-8p5c-f836-m4h7 · CVE-2019-8158 · GitHub	critical	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-47h6-hfpv-7phj · CVE-2019-8159 · GitHub	high	>=2.3,<2.3.2-p2 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento Cross-Site Scripting via admin panel GHSA-vrw4-34p5-pjg5 · CVE-2019-8157 · GitHub	medium	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-86pc-6mm8-542r · CVE-2019-8148 · GitHub	medium	>=2.3.0,<2.3.2-p2	2.3.2-p2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-v8fg-p27h-mxjp · CVE-2019-8147 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-vpg9-gq7j-mxqg · CVE-2019-8144 · GitHub	critical	>=2.3,<2.3.2-p1	2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-jjmg-xmq2-g6ff · CVE-2019-8152 · GitHub	medium	>=2.3,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento Cross-site Scripting (XSS) GHSA-273r-v888-vgc6 · CVE-2019-8153 · GitHub	medium	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento Injection vulnerability via email templates GHSA-94q8-gx29-6mqv · CVE-2019-8143 · GitHub	medium	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-6m27-3r8q-c7f7 · CVE-2019-8146 · GitHub	medium	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-9wr9-fw9v-8fgr · CVE-2019-8141 · GitHub	high	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento Unrestricted file upload vulnerability GHSA-7pr3-34rg-g53m · CVE-2019-8140 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10	2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-298q-wv2h-v5vw · CVE-2019-8142 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-85xw-3hp5-6fmc · CVE-2019-8138 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento SQL injection via marketing account with access to email templates variables GHSA-45gj-78hc-4mvc · CVE-2019-8134 · GitHub	high	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-gjjm-4x3g-3h33 · CVE-2019-8139 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-jrjx-8gmw-jj2q · CVE-2019-8137 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition Insecure Component GHSA-xgcp-59g2-wm8g · CVE-2019-8136 · GitHub	critical	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override GHSA-wg25-j79r-v5wp · CVE-2019-8129 · GitHub	medium	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-5v5p-x8c2-mqxp · CVE-2019-8122 · GitHub	high	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento SQL injection vulnerability GHSA-x42g-82pp-4v6g · CVE-2019-8130 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-vx7m-v8v2-fhwm · CVE-2019-8131 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-g378-6fg4-gx3v · CVE-2019-8132 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento Cross-Site Scripting via store name GHSA-mhwc-4w67-xq2c · CVE-2019-8128 · GitHub	medium	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-v99w-jxr4-w6mc · CVE-2019-8117 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition Insufficient Logging GHSA-x5q5-6wvf-2fpq · CVE-2019-8124 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-29mr-gr4c-vf9c · CVE-2019-8115 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-j63v-wcf9-c9hm · CVE-2019-8119 · GitHub	high	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition Insufficient Logging GHSA-fp5m-4mqh-849p · CVE-2019-8123 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-985w-mqqp-7287 · CVE-2019-8120 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition Weak Cryptography GHSA-hmch-9947-82rj · CVE-2019-8118 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10 \| >=2.1.0,<2.1.19	2.1.19, 2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition SQLi Vulnerability GHSA-2x2q-2xpv-mcf9 · CVE-2019-8127 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition RCE Vulnerability via CSRF GHSA-x72m-p4qc-p7rv · CVE-2019-8109 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento Broken authentication and session managememt GHSA-92ph-xm9v-cg3j · CVE-2019-8108 · GitHub	medium	>=2.3,<2.3.2-p2 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Edition Arbitrary File Deletion GHSA-2cg3-w597-rjfv · CVE-2019-8107 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-56hf-w8gm-448q · CVE-2019-8092 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-crv7-r357-gw3w · CVE-2019-8114 · GitHub	high	>=2.3.0,<2.3.2-p2 \| >=2.2.0,<2.2.10 \| <1.9.4.3	1.9.4.3, 2.2.10, 2.3.2-p2
2022-05-24	Magento 2 Community Weak PRNG GHSA-c4r2-3f9r-rwp8 · CVE-2019-8113 · GitHub	medium	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-gfcq-wh3g-c6h4 · CVE-2019-8110 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition Security Bypass GHSA-p9vf-4jx2-5hpp · CVE-2019-8112 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-2crc-5vq6-386r · CVE-2019-8111 · GitHub	high	>=2.3.0,<2.3.2-p1 \| >=2.2.0,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento Information Disclosure via File upload functionality GHSA-32x5-6p4q-q8jh · CVE-2019-8093 · GitHub	high	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2022-05-24	Magento 2 Community Edition Arbitrary File Deletion GHSA-653q-vqm6-gmjm · CVE-2019-8090 · GitHub	medium	>=2.3.0,<2.3.3 \| >=2.2.0,<2.2.10	2.2.10, 2.3.3
2022-05-24	Magento 2 Community Edition Information Leak GHSA-5j25-5hjr-w7m2 · CVE-2019-7951 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Access Control Bypass GHSA-2fhr-f6q6-c4p2 · CVE-2019-7950 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition CSRF vulnerability GHSA-w392-68rg-pgg4 · CVE-2019-7947 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE GHSA-vvf9-fxhv-4rgj · CVE-2019-7942 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-3mxq-v9rw-m6x9 · CVE-2019-7944 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-cgm7-gjhw-rrf6 · CVE-2019-7940 · GitHub	medium	>2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-mf6x-7766-5cg8 · CVE-2019-7936 · GitHub	medium	>=2.1.0,<2.1.18 \| >=2.2.0,<2.2.9 \| >=2.3.0,<2.3.2	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Reflected cross-site scripting on customer cart page GHSA-r728-jwf5-f5r5 · CVE-2019-7939 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-94fc-rxhv-vvf8 · CVE-2019-7937 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-mgfr-44wv-hqv6 · CVE-2019-7938 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-5c4g-p858-498x · CVE-2019-7935 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-c45w-p293-7cv6 · CVE-2019-7945 · GitHub	medium	>=2.2.0,<2.2.9 \| >=2.3.0,<2.3.2 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Unrestricted File Upload GHSA-3h69-4frw-g2jm · CVE-2019-7930 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-77mv-p94f-qcq4 · CVE-2019-7934 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-969v-mwp3-4mr3 · CVE-2019-7932 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Insecure Direct Object Reference (IDOR) vulnerability GHSA-7g5j-q8qj-8984 · CVE-2019-7925 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Information Disclosure GHSA-h522-94xp-2xr6 · CVE-2019-7929 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Filter extension bypass via crafted store configuration keys GHSA-f8h9-7rpq-7qcc · CVE-2019-7912 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-gg96-8w9x-7rx9 · CVE-2019-7921 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition SSRF vulnerability GHSA-hppc-rpfp-r8qw · CVE-2019-7913 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Server-Side Request Forgery vulnerability GHSA-33cj-w75f-49m2 · CVE-2019-7911 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-r68f-45jg-64m6 · CVE-2019-7927 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-525g-rvh4-v5c9 · CVE-2019-7926 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition DoS vulnerability GHSA-prw8-gqwp-f7fh · CVE-2019-7915 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition SSRF vulnerability GHSA-hvcp-jvx5-4pmp · CVE-2019-7923 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition DoS vulnerability GHSA-hrg3-4q56-p2q5 · CVE-2019-7928 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Injection Vulnerability GHSA-hxmp-jcqj-83hm · CVE-2019-7889 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition IDOR Vulnerability GHSA-3pgc-7jf3-5x5g · CVE-2019-7890 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Information Disclosure GHSA-274w-2j5w-m2xj · CVE-2019-7899 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-jhvh-mjfg-5m99 · CVE-2019-7903 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-2x55-mg9r-24f7 · CVE-2019-7896 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Cross-site Scripting in the admin panel GHSA-mgfv-4whf-c574 · CVE-2019-7908 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-mw5w-cf76-73m8 · CVE-2019-7895 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Information Disclosure GHSA-vqxq-3wqv-r9xp · CVE-2019-7898 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Insufficient Access Controls GHSA-5hcx-vg88-hgpm · CVE-2019-7904 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability via SSRF GHSA-w3r8-fxv5-58pp · CVE-2019-7892 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-pw2f-m22m-p75c · CVE-2019-7909 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-jxp3-mmw7-8285 · CVE-2019-7897 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-mp9r-rh95-f8f8 · CVE-2019-7885 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cryptographic Flaw GHSA-c2gg-rrhc-fvvg · CVE-2019-7886 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-rj8f-g5gm-jw5c · CVE-2019-7887 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Information Disclosure GHSA-9pgc-rvp9-rqv3 · CVE-2019-7888 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-ff7r-7rrm-wx6w · CVE-2019-7882 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-ccjm-rgm5-rjjh · CVE-2019-7880 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-qmwh-rh2g-3682 · CVE-2019-7875 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-v5m6-2m78-4vr2 · CVE-2019-7877 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-8v75-8jj8-77gf · CVE-2019-7874 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Cross-site Scripting in the admin panel GHSA-g4jh-vxqm-6fff · CVE-2019-7868 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition RCE Vulnerability GHSA-6qh6-v99h-vh4c · CVE-2019-7876 · GitHub	high	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-7xqv-jgv6-x2h8 · CVE-2019-7881 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Insufficient authorization check when adding users to company accounts GHSA-pfxv-66r9-4gqw · CVE-2019-7872 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Stored cross-site scripting in admin panel GHSA-p8gw-x2p7-vc73 · CVE-2019-7863 · GitHub	medium	>=2.3,<2.3.2 \| >=2.2,<2.2.9 \| >=2.1,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cross-site Scripting Vulnerability GHSA-8578-mmf4-f327 · CVE-2019-7873 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Stored Cross-site Scripting vulnerability in the admin panel GHSA-9f4p-3jgf-98f5 · CVE-2019-7869 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Unsafe File Upload GHSA-v527-6h5r-cfg8 · CVE-2019-7871 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-vx2g-f45p-j674 · CVE-2019-7867 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-m3v2-r236-5xgq · CVE-2019-7862 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition IDOR Vulnerability GHSA-hpxv-vpfv-7jc9 · CVE-2019-7854 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Unsafe File Upload GHSA-j837-vm6w-6qcv · CVE-2019-7861 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition IDOR Vulnerability GHSA-c33v-23rx-7qqc · CVE-2019-7864 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition CSRF Vulnerability GHSA-wmrg-w9vg-7jqx · CVE-2019-7865 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Cryptographic Flaw GHSA-7h8v-f2g9-39fx · CVE-2019-7858 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-3ccx-7588-r6c6 · CVE-2019-7866 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Weak PRNG GHSA-8v9h-m7pj-hx7c · CVE-2019-7860 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Path Traversal Vulnerability GHSA-hqhf-8jgc-h5hx · CVE-2019-7859 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento Cross-Site Request Forgery (CSRF) GHSA-f6ww-vqw2-xp3v · CVE-2019-7857 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.1.0,<2.1.18 \| >=2.2.0,<2.2.9	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Path Disclosure GHSA-xcgp-c6hp-cj4r · CVE-2019-7852 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition Session Fixation Check GHSA-v797-hfv8-v2xm · CVE-2019-7849 · GitHub	high	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition CSRF vulnerability GHSA-mhvf-j94g-3qp7 · CVE-2019-7851 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Cryptographic Flaw GHSA-2w26-gmqm-mc5p · CVE-2019-7855 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-24	Magento 2 Community Edition XSS Vulnerability GHSA-mjgf-xmrr-6gvx · CVE-2019-7853 · GitHub	medium	>=2.3.0,<2.3.2 \| >=2.2.0,<2.2.9 \| >=2.1.0,<2.1.18	2.1.18, 2.2.9, 2.3.2
2022-05-14	Magento Cross-Site Request Forgery (CSRF) GHSA-w3mq-67mw-3p9f · CVE-2018-5301 · GitHub	medium	>=2.1.0,<2.1.2 \| <2.0.10	2.0.10, 2.1.2
2022-02-17	Magento improper input validation vulnerability GHSA-f8fv-f786-9933 · CVE-2022-24086 · GitHub	critical	>=2.4.0,<2.4.3-p2 \| >=2.3.3-p1,<2.3.7-p3	2.3.7-p3, 2.4.3-p2
2019-11-20	Unauthenticated crypto and weak IV in Magento\Framework\Encryption GHSA-h7qw-mxrm-c6h2 · CVE-2016-6485 · GitHub	high	>=2.0,<2.2.6	2.2.6
2019-11-12	Composer JavaScript injection possible via html comments GHSA-fm68-89m8-4gjj · CVE-2019-8233 · GitHub	medium	>=2.3,<2.3.3 \| >=2.2,<2.2.10	2.2.10, 2.3.3
2019-11-12	Magento Cross-Site Scripting via Attribute Set Name GHSA-xv69-f7x5-r4qw · CVE-2019-8145 · GitHub	medium	>=2.3,<2.3.2-p1 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p1
2019-11-12	Bypass of sitemp access restrictions GHSA-62fx-3v4f-mwxm · CVE-2019-8133 · GitHub	medium	>=2.3,<2.3.2-p2 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p2
2019-11-12	Remote code execution via vulnerable Symphony dependecy injection GHSA-3q5x-7mxp-rp6j · CVE-2019-8135 · GitHub	critical	>=2.3,<2.3.2-p2 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p2
2019-11-12	Using JS libraries with known security vulnerabilities GHSA-89ch-hqf9-rgp3 · CVE-2019-8121 · GitHub	high	>=2.3,<2.3.3 \| >=2.2,<2.2.10	2.2.10, 2.3.3
2019-11-12	Information disclosure through processing of external XML entities GHSA-427g-2r83-3ccm · CVE-2019-8126 · GitHub	medium	>=2.3,<2.3.2-p2 \| >=2.2,<2.2.10	2.2.10, 2.3.2-p2

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Check your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.

Check composer.lock

Questions about magento/community-edition

Does magento/community-edition have known vulnerabilities?

Yes. Packagist lists 361 security advisories for magento/community-edition (47 critical, 104 high, 193 medium, 17 low severity). The most recent, reported 2025-10-14, is "Magento allows incorrect authorization". The newest release, 2.4.9, is still inside the affected range of 1 of them.

Which version of magento/community-edition should I run?

The newest stable release is 2.4.9 (published 2026-05-04). The most recent advisory is fixed in 2.4.6-p13, 2.4.7-p8, 2.4.8-p3 and 2.4.9-alpha3, so stay on or above the fixed version for your major version. Run composer update magento/community-edition, then composer audit to confirm nothing else is flagged.

How do I check if my magento/community-edition version is affected?

Run composer show magento/community-edition in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

Where this data comes from

Advisories come from the Packagist security advisories API, which collects the GitHub Advisory Database and the FriendsOfPHP security advisories. composer audit reads the same data. Releases come from packagist.org. Last synced 2026-11-03; we re-check daily. Each advisory links to its source. Spot an error? Tell us.

← All PHP packages