Exposición de Magento
CMS, Ecommerce435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2019-7858—A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitEPSS 0.7%CVE-2019-7925—An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prioEPSS 0.7%CVE-2019-8118—Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed loEPSS 0.7%CVE-2026-77110HIGHAdobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 0.7%CVE-2023-29287MEDIUMAdobe Commerce Information Exposure Security feature bypassEPSS 0.7%CVE-2026-47998MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.7%CVE-2026-47997MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.7%CVE-2021-32684MEDIUMMissing Handler in @scandipwa/magento-scriptsEPSS 0.7%CVE-2026-40488HIGHOpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code ExecutionEPSS 0.7%CVE-2026-47988HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.7%CVE-2026-34651HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 0.7%CVE-2026-34647HIGHAdobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 0.7%CVE-2023-29295MEDIUMInsecure Direct Object Reference (IDOR) in Create Quote FunctionEPSS 0.6%CVE-2023-29296MEDIUM[Cloud] Customer suspects IDOR vulnerabilityEPSS 0.6%CVE-2026-47984HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.6%CVE-2026-21360MEDIUMAdobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 0.6%CVE-2026-48413HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-29290MEDIUMAdobe Commerce Guest Cart Shipping Address Overwrite IDOR EPSS 0.6%CVE-2026-47994HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2026-34654MEDIUMAdobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)EPSS 0.6%