Magento open source

This hub aggregates every CVE we track for Magento open source, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Magento open source.

• CVE-2026-76200Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)9.3Sep 8, 2026
• CVE-2026-76201Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)9.3Sep 8, 2026
• CVE-2026-77109Adobe Commerce | Incorrect Authorization (CWE-863)8.6Sep 8, 2026
• CVE-2026-77110Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)7.6Sep 8, 2026
• CVE-2026-77108Adobe Commerce | Incorrect Authorization (CWE-863)7.5Sep 8, 2026
• CVE-2026-76202Adobe Commerce | Incorrect Authorization (CWE-863)8.2Sep 8, 2026
• CVE-2026-77774Adobe Commerce | Incorrect Authorization (CWE-863)8.6Sep 8, 2026
• CVE-2026-77111Adobe Commerce | Incorrect Authorization (CWE-863)8.7Sep 8, 2026
• CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)KEV10.0Sep 7, 2026
• CVE-2026-48416Adobe Commerce | Incorrect Authorization (CWE-863)7.5Aug 11, 2026
• CVE-2026-48414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)7.7Aug 11, 2026
• CVE-2026-48413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7Aug 11, 2026
• CVE-2026-48415Adobe Commerce | Incorrect Authorization (CWE-863)7.6Aug 11, 2026
• CVE-2026-48412Adobe Commerce | Incorrect Authorization (CWE-863)2.7Aug 11, 2026
• CVE-2026-48411Adobe Commerce | Incorrect Authorization (CWE-863)6.5Aug 11, 2026