Exposición de Magento
CMS, Ecommerce435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2026-77108HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.5%CVE-2026-77111HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.5%CVE-2026-76200CRITICALAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-76201CRITICALAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-48000MEDIUMAdobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)EPSS 0.5%CVE-2026-21290HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-21361HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2019-7947—A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and MagenEPSS 0.4%CVE-2019-7874—A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. ThEPSS 0.4%CVE-2019-7851—A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead tEPSS 0.4%CVE-2026-34646HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-77109HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-47999MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-34686HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-47995HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-48412LOWAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-76202HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-34656MEDIUMAdobe Commerce | Improper Authorization (CWE-285)EPSS 0.4%CVE-2026-48371MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2021-21395MEDIUMMagneto-lts vulnerable to Cross-Site Request ForgeryEPSS 0.4%