Exposição de Magento
CMS, Ecommerce435
score de exposição
33.253
sites usam
3
em exploração
34
críticos
Análise Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2026-21284HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2019-7873—A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. ThEPSS 0.4%CVE-2019-7857—A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause EPSS 0.4%CVE-2023-34379MEDIUMWordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2026-34685LOWAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.4%CVE-2026-34655MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-41676MEDIUMMagento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configsEPSS 0.4%CVE-2026-21297MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.4%CVE-2026-48415HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.3%CVE-2026-21296MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.3%CVE-2026-21311HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-42155CRITICALMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsEPSS 0.3%CVE-2026-21310MEDIUMAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.3%CVE-2026-25523MEDIUMMagento's X-Original-Url header can expose admin urlEPSS 0.3%CVE-2026-21286MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.3%CVE-2026-34658MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-21291MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-42458MEDIUMMagento LTS: Reflected XSS - Import -> Data Flow (profiles)EPSS 0.3%CVE-2025-27400LOWMagento vulnerable to stored XSS in theme config fieldsEPSS 0.3%CVE-2026-21292MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%