Magento open source

This hub aggregates every CVE we track for Magento open source, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Magento open source.

• CVE-2026-48414Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)7.7Aug 11, 2026
• CVE-2026-48416Adobe Commerce | Incorrect Authorization (CWE-863)7.5Aug 11, 2026
• CVE-2026-48413Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7Aug 11, 2026
• CVE-2026-48415Adobe Commerce | Incorrect Authorization (CWE-863)7.6Aug 11, 2026
• CVE-2026-48412Adobe Commerce | Incorrect Authorization (CWE-863)2.7Aug 11, 2026
• CVE-2026-48411Adobe Commerce | Incorrect Authorization (CWE-863)6.5Aug 11, 2026
• CVE-2026-71362Adobe Commerce | Incorrect Authorization (CWE-863)9.1Aug 11, 2026
• CVE-2026-47984Adobe Commerce | Incorrect Authorization (CWE-863)8.2Jul 14, 2026
• CVE-2026-47997Adobe Commerce | Incorrect Authorization (CWE-863)5.9Jul 14, 2026
• CVE-2026-47988Adobe Commerce | Incorrect Authorization (CWE-863)8.6Jul 14, 2026
• CVE-2026-47999Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)4.8Jul 14, 2026
• CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)9.1Jul 14, 2026
• CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)9.3Jul 14, 2026
• CVE-2026-47998Adobe Commerce | Incorrect Authorization (CWE-863)5.9Jul 14, 2026
• CVE-2026-48000Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)6.1Jul 14, 2026