Commerce

This hub aggregates every CVE we track for Commerce, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Commerce.

• CVE-2026-21824A privilege escalation vulnerability affects HCL Commerce8.8Jul 20, 2026
• CVE-2026-47984Adobe Commerce | Incorrect Authorization (CWE-863)8.2Jul 14, 2026
• CVE-2026-47997Adobe Commerce | Incorrect Authorization (CWE-863)5.9Jul 14, 2026
• CVE-2026-47988Adobe Commerce | Incorrect Authorization (CWE-863)8.6Jul 14, 2026
• CVE-2026-47999Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)4.8Jul 14, 2026
• CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)9.1Jul 14, 2026
• CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)9.3Jul 14, 2026
• CVE-2026-47998Adobe Commerce | Incorrect Authorization (CWE-863)5.9Jul 14, 2026
• CVE-2026-48000Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)6.1Jul 14, 2026
• CVE-2026-47995Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.1Jul 14, 2026
• CVE-2026-48001Adobe Commerce | Information Exposure (CWE-200)3.7Jul 14, 2026
• CVE-2026-48371Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)5.4Jul 14, 2026
• CVE-2026-47994Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7Jul 14, 2026
• CVE-2026-47996Adobe Commerce | Incorrect Authorization (CWE-863)6.8Jul 14, 2026
• CVE-2026-47992Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)7.2Jul 14, 2026