Exposição de Magento
CMS, Ecommerce435
score de exposição
33.253
sites usam
3
em exploração
34
críticos
Análise Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2026-34653HIGHAdobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 0.6%CVE-2026-21289HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.6%CVE-2019-8157—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8152—A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, MagentoEPSS 0.6%CVE-2019-7882—A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce priorEPSS 0.6%CVE-2019-7945—A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento EPSS 0.6%CVE-2019-7944—A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento CommerEPSS 0.6%CVE-2019-7921—A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, MEPSS 0.6%CVE-2023-22251MEDIUMAdobe Commerce Incorrect Authorization Security feature bypassEPSS 0.6%CVE-2026-34645HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.6%CVE-2026-21309HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.6%CVE-2019-8112—A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bEPSS 0.6%CVE-2019-7863—A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2EPSS 0.6%CVE-2019-7866—A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.EPSS 0.6%CVE-2019-7867—A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.EPSS 0.6%CVE-2019-7934—A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toEPSS 0.6%CVE-2019-7862—A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior tEPSS 0.6%CVE-2019-7880—A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.EPSS 0.6%CVE-2019-7887—A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce priorEPSS 0.6%CVE-2019-7897—A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior toEPSS 0.6%