Exposure of Magento

CMS, Ecommerce
499
exposure score
32,588
sites use
4
exploited
39
critical

CVEs

361 results
CVE-2026-48000MEDIUMAdobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)EPSS 0.5%CVE-2026-21284HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2019-7851—A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead tEPSS 0.4%CVE-2019-7874—A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. ThEPSS 0.4%CVE-2019-7947—A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and MagenEPSS 0.4%CVE-2026-34646HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-92910HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-47999MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-34686HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-21297MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-34656MEDIUMAdobe Commerce | Improper Authorization (CWE-285)EPSS 0.4%CVE-2026-48371MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-21296MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2021-21395MEDIUMMagneto-lts vulnerable to Cross-Site Request ForgeryEPSS 0.4%CVE-2019-7873—A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. ThEPSS 0.4%CVE-2019-7857—A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause EPSS 0.4%CVE-2023-34379MEDIUMWordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2026-34685LOWAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.4%CVE-2026-34655MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-42155CRITICALMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsEPSS 0.4%