magento/project-community-edition (Packagist)
Advisories
162
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.9.4.3 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require magento/project-community-edition:^1.9.4.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qvwr-p3hj-j6jf Magento vulnerable to privilege escalation due to incorrect authorization |
Medium EPSS 0.43% |
<= 2.0.2 | No fix yet |
| GHSA-pcrx-r49h-x2w5 Magento vulnerable to stored Cross-Site Scripting (XSS) |
Medium EPSS 0.27% |
<= 2.0.2 | No fix yet |
| GHSA-r355-75hw-r8jf Magento allows incorrect authorization |
Medium EPSS 0.55% |
<= 2.0.2 | No fix yet |
| GHSA-2768-5wmv-cfff Magento vulnerable to stored Cross-Site Scripting (XSS) |
High EPSS 0.60% |
<= 2.0.2 | No fix yet |
| GHSA-69x9-xp2j-w8g8 Magento provides incorrect authorization through a security feature bypass |
High EPSS 0.60% |
<= 2.0.2 | No fix yet |
| GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability Known exploited |
Critical EPSS 95.35% |
<= 2.0.2 | No fix yet |
| GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability Known exploited |
Critical EPSS 95.35% |
<= 2.0.2 | No fix yet |
| GHSA-h4f4-gv6h-x824 Magento vulnerable to path traversal |
Medium EPSS 0.66% |
<= 2.0.2 | No fix yet |
| GHSA-wcmw-8xpp-rwfj Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Medium EPSS 0.40% |
<= 2.0.2 | No fix yet |
| GHSA-8mq8-c243-2335 Magento Cross-site Scripting vulnerability |
High EPSS 0.64% |
<= 2.0.2 | No fix yet |
| GHSA-7hrj-3c9x-xv5h Magento has incorrect authorization issue that leads to arbitrary file system read |
High EPSS 0.60% |
<= 2.0.2 | No fix yet |
| GHSA-5777-jj7p-mpqw Magento Cross-Site Request Forgery (CSRF) vulnerability |
High EPSS 0.88% |
<= 2.0.2 | No fix yet |
| GHSA-xgfm-992v-h2hr Magento vulnerable to denial of service |
High EPSS 0.56% |
<= 2.0.2 | No fix yet |
| GHSA-8hcx-xvww-6c6h Magento Security feature bypass |
Medium EPSS 0.37% |
<= 2.0.2 | No fix yet |
| GHSA-85jx-x9r4-45m2 Magento Authenticated Security feature bypass |
Low EPSS 0.39% |
<= 2.0.2 | No fix yet |
| GHSA-r487-9vv5-75gg Magento Improper Authorization leading to security feature bypass |
High EPSS 0.53% |
<= 2.0.2 | No fix yet |
| GHSA-g2pj-xmxq-3r9q Magento Improper Access Control leads to security feature bypass |
Medium EPSS 0.47% |
<= 2.0.2 | No fix yet |
| GHSA-2r94-wm5v-4prx Magento does not properly protect credentials |
Low EPSS 0.49% |
<= 2.0.2 | No fix yet |
| GHSA-vhcq-4xrm-2cr2 Magento Improper Access Control leads to Security feature bypass |
Medium EPSS 0.50% |
<= 2.0.2 | No fix yet |
| GHSA-6wq7-cg9h-mj6q Magento Improper Access Control leads to Security feature bypass |
Medium EPSS 0.54% |
<= 2.0.2 | No fix yet |
| GHSA-8884-7rm9-mrx4 Magento stored Cross-Site Scripting (XSS) vulnerability |
High EPSS 0.80% |
<= 2.0.2 | No fix yet |
| GHSA-469f-wf4f-3jjv Magento Improper Access Control vulnerability |
Medium EPSS 0.45% |
<= 2.0.2 | No fix yet |
| GHSA-ghpr-6qhr-rpp8 Magento Improper Access Control vulnerability |
Medium EPSS 0.55% |
<= 2.0.2 | No fix yet |
| GHSA-82p4-55gj-956p Magento Improper Access Control vulnerability |
Medium EPSS 0.53% |
<= 2.0.2 | No fix yet |
| GHSA-fppq-f2m6-xv5c Improper Authorization vulnerability in Magento and Adobe Commerce |
Critical EPSS 17.19% |
<= 2.0.2 | No fix yet |
| GHSA-7jmr-43qj-pw47 Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Low EPSS 0.40% |
<= 2.0.2 | No fix yet |
| GHSA-6w27-c66f-gvhq Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability |
Low EPSS 0.40% |
<= 2.0.2 | No fix yet |
| GHSA-656q-fx2w-8ccv Magento Improper Access Control vulnerability |
Low EPSS 0.50% |
<= 2.0.2 | No fix yet |
| GHSA-mm87-rrqx-94cr Magento stored Cross-Site Scripting (XSS) vulnerability |
Medium EPSS 0.41% |
<= 2.0.2 | No fix yet |
| GHSA-v3hq-g424-5mgg Magento Improper Access Control vulnerability |
Medium EPSS 0.63% |
<= 2.0.2 | No fix yet |
| GHSA-6ff8-jrfg-43hh Magento Business Logic Error vulnerability |
Medium EPSS 0.63% |
<= 2.0.2 | No fix yet |
| GHSA-539v-w87w-w62c Magento Improper Access Control vulnerability |
Medium EPSS 0.77% |
<= 2.0.2 | No fix yet |
| GHSA-v6r2-425c-hfrr Magento Incorrect Authorization vulnerability |
Medium EPSS 0.55% |
<= 2.0.2 | No fix yet |
| GHSA-g3j6-9753-8mp2 Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-rjjw-g6hw-7pc9 Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-gc27-rvvm-q77r Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-fhw6-3mj5-w9gv Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-xwgx-8v72-4j5j Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-m4rg-mpp2-97px Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-36hw-x3cc-m258 Magento Improper Access Control vulnerability |
High EPSS 0.91% |
<= 2.0.2 | No fix yet |
| GHSA-gjxp-46rq-wg4q Magento Stored Cross-Site Scripting (XSS) Vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-vw47-79jv-3598 Adobe Commerce Improper Authorization vulnerability |
High EPSS 0.68% |
<= 2.0.2 | No fix yet |
| GHSA-3cfg-w257-cgf8 Magento Information Exposure vulnerability |
Medium EPSS 0.96% |
<= 2.0.2 | No fix yet |
| GHSA-954p-ff72-327w Adobe Commerce Path Traversal |
High EPSS 1.40% |
<= 2.0.2 | No fix yet |
| GHSA-74w7-cr4v-wf2v Magento Improper Access Control Leads to Privilege escalation |
Medium EPSS 0.43% |
<= 2.0.2 | No fix yet |
| GHSA-gvgf-pvh5-vjh4 Magento Improper Authorization vulnerability |
Medium EPSS 0.41% |
<= 2.0.2 | No fix yet |
| GHSA-4xmj-f664-hv98 Magento Improper Authorization leads to Security feature bypass |
Medium EPSS 0.44% |
<= 2.0.2 | No fix yet |
| GHSA-4xgg-rw35-7mv5 Magento Improper Authorization leads to Security feature bypass |
Medium EPSS 0.42% |
<= 2.0.2 | No fix yet |
| GHSA-gj93-84g5-mcjq Magento Improper Authorization Leading to Security feature bypass |
Medium EPSS 0.44% |
<= 2.0.2 | No fix yet |
| GHSA-x6f9-hv9r-fgq4 Magento Improper Access Control Leads to Privilege escalation |
Medium EPSS 0.44% |
<= 2.0.2 | No fix yet |
| GHSA-8w5f-8992-g86j Magento Improper Authorization vulnerability |
Medium EPSS 0.44% |
<= 2.0.2 | No fix yet |
| GHSA-qm77-mqf3-fmhq Magento Improper Authorization leads to security feature bypass |
Medium EPSS 0.44% |
<= 2.0.2 | No fix yet |
| GHSA-cjm6-8mw8-2f8c Magento Improper Authorization vulnerability |
Medium EPSS 0.43% |
<= 2.0.2 | No fix yet |
| GHSA-5g9f-7gqc-8hj4 Magento Improper Authorization vulnerability |
Medium EPSS 0.43% |
<= 2.0.2 | No fix yet |
| GHSA-qrh3-vxjg-h9h6 Magento Improper Authorization vulnerability |
Medium EPSS 0.46% |
<= 2.0.2 | No fix yet |
| GHSA-mmp7-8cg4-9wrg Magento Stored Cross-Site Scripting (XSS) vulnerability |
High EPSS 0.54% |
<= 2.0.2 | No fix yet |
| GHSA-2ff6-837j-hg5x Magento OS Command ('OS Command Injection') vulnerability |
High EPSS 1.67% |
<= 2.0.2 | No fix yet |
| GHSA-8frp-pxq2-3gpq Magento OS Command ('OS Command Injection') vulnerability |
High EPSS 1.67% |
<= 2.0.2 | No fix yet |
| GHSA-52fg-wjxm-pp44 Magento DOM-based Cross-Site Scripting (XSS) vulnerability |
High EPSS 0.70% |
<= 2.0.2 | No fix yet |
| GHSA-7r99-8wqp-h7pc Magento Path Traversal vulnerability |
High EPSS 0.91% |
<= 2.0.2 | No fix yet |
| GHSA-q628-54wg-4r5q Magento does not properly restrict excessive authentication attempts |
High EPSS 0.86% |
<= 2.0.2 | No fix yet |
| GHSA-59vf-hjxc-f9c5 Magento Open Source allows Cross-Site Scripting (XSS) |
High EPSS 1.03% |
<= 2.0.2 | No fix yet |
| GHSA-wh4m-6rh3-p4rq Magento Open Source allows Improper Input Validation |
Critical EPSS 1.42% |
<= 2.0.2 | No fix yet |
| GHSA-525f-pvj5-vqmq Magento Open Source allows OS Command Injection |
Critical EPSS 3.69% |
<= 2.0.2 | No fix yet |
| GHSA-264g-f7v8-q5qq Magento Open Source allows Cross-Site Scripting (XSS) |
Critical EPSS 1.31% |
<= 2.0.2 | No fix yet |
| GHSA-hqgj-4396-hmxv Magento Open Source allows Cross-Site Request Forgery (CSRF) |
Medium EPSS 0.76% |
<= 2.0.2 | No fix yet |
| GHSA-c9h9-h5gf-885r Magento Open Source allows Uncontrolled Resource Consumption |
Medium EPSS 0.87% |
<= 2.0.2 | No fix yet |
| GHSA-7pfc-834q-h497 Magento Open Source allows Uncontrolled Resource Consumption |
Medium EPSS 0.76% |
<= 2.0.2 | No fix yet |
| GHSA-h3g9-cwr6-hphx Magento Open Source allows SQL Injection |
Medium EPSS 0.83% |
<= 2.0.2 | No fix yet |
| GHSA-rq36-9f5f-2gw7 Magento Open Source allows SQL Injection |
Medium EPSS 0.83% |
<= 2.0.2 | No fix yet |
| GHSA-ggr8-3hwx-4f2m Magento Open Source allows SQL Injection |
Medium EPSS 0.83% |
<= 2.0.2 | No fix yet |
| GHSA-grc6-r6f8-xj7c Magento Open Source allows Improper Authorization |
High EPSS 0.80% |
<= 2.0.2 | No fix yet |
| GHSA-3j7w-jp46-9752 Magento Open Source allows Cross-Site Scripting (XSS) |
High EPSS 0.75% |
<= 2.0.2 | No fix yet |
| GHSA-rpc7-gf58-v3x2 Magento Open Source allows Incorrect Authorization |
High EPSS 0.88% |
<= 2.0.2 | No fix yet |
| GHSA-9mx6-4gg4-85xj Magento Open Source has Improper Input Validation Vulnerability |
Medium EPSS 0.80% |
<= 2.0.2 | No fix yet |
| GHSA-8jxc-5f94-22vh Magento Open Source allows Server-Side Request Forgery (SSRF) |
Medium EPSS 0.86% |
<= 2.0.2 | No fix yet |
| GHSA-5xmp-7wg5-x68q Magento Open Source affected by Improper Input Validation |
High EPSS 1.51% |
<= 2.0.2 | No fix yet |
| GHSA-wqr6-wv6c-p8fx Magento improper access control vulnerability within Magento's Media Gallery Upload workflow |
High EPSS 2.12% |
<= 2.0.2 | No fix yet |
| GHSA-8cjg-f53m-8m9q Magento XML Injection vulnerability in the Widgets Update Layout |
High EPSS 2.37% |
<= 2.0.2 | No fix yet |
| GHSA-4g27-q2w9-m8m8 Magento affected by remote code execution vulnerability in the CMS page scheduled update feature |
High EPSS 2.01% |
<= 2.0.2 | No fix yet |
| GHSA-3vg2-v639-6ch9 Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.97% |
<= 2.0.2 | No fix yet |
| GHSA-mxc9-g6m4-2v35 Magento Open Source allows Improper Neutralization of Special Elements Used |
High EPSS 2.55% |
<= 2.0.2 | No fix yet |
| GHSA-rpv2-g4pc-wp72 Magento Open Source allows XML Injection |
High EPSS 1.07% |
<= 2.0.2 | No fix yet |
| GHSA-gfmm-ww6f-5mm5 Magento Open Source allows Improper Neutralization of Special Elements Used |
High EPSS 1.35% |
<= 2.0.2 | No fix yet |
| GHSA-3qr4-w96f-672v Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.65% |
<= 2.0.2 | No fix yet |
| GHSA-354h-fpmq-68v7 Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.65% |
<= 2.0.2 | No fix yet |
| GHSA-28vp-39rf-3q2j Magento Open Source has Business Logic Errors Vulnerability |
Medium EPSS 0.74% |
<= 2.0.2 | No fix yet |
| GHSA-66c9-xrwj-9xv6 Magento Open Source affected by Improper Input Validation |
Low EPSS 1.01% |
<= 2.0.2 | No fix yet |
| GHSA-4588-7x48-jrgj Magento Open Source allows Server-Side Request Forgery (SSRF) |
Medium EPSS 0.95% |
<= 2.0.2 | No fix yet |
| GHSA-5f79-vhr4-vw2r Magento Open Source allows Server-Side Request Forgery (SSRF) |
Medium EPSS 1.09% |
<= 2.0.2 | No fix yet |
| GHSA-qw5m-vmp3-f553 Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.63% |
<= 2.0.2 | No fix yet |
| GHSA-wh42-8r2w-873x Magento Open Source allows XML Injection |
Medium EPSS 0.88% |
<= 2.0.2 | No fix yet |
| GHSA-f989-3fp9-q3r2 Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.65% |
<= 2.0.2 | No fix yet |
| GHSA-85m4-g9vq-xpxj Magento Open Source allows Information Exposure |
Medium EPSS 0.71% |
<= 2.0.2 | No fix yet |
| GHSA-5jfg-phx7-7fxg Magento Open Source affected by Improper Input Validation |
High EPSS 1.02% |
<= 2.0.2 | No fix yet |
| GHSA-2wm7-mmgc-qxr3 Magento Open Source allows Incorrect Authorization |
Medium EPSS 0.56% |
<= 2.0.2 | No fix yet |
| GHSA-4h7p-4vq8-g2gh Magento Open Source allows Improper Access Control |
Medium EPSS 0.96% |
<= 2.0.2 | No fix yet |
| GHSA-2444-8gj8-6fmx Magento Open Source allows XML Injection |
High EPSS 0.93% |
<= 2.0.2 | No fix yet |
| GHSA-4vj2-426r-jm3g Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) |
Critical EPSS 14.68% |
<= 2.0.2 | No fix yet |
| GHSA-5fxx-jwjm-x9hj Magento Open Source allows Improper Access Control |
Medium EPSS 1.44% |
<= 2.0.2 | No fix yet |
| GHSA-gm4m-9rm8-7rxj Magento Open Source has Improper Access Control vulnerability |
Medium EPSS 0.84% |
<= 2.0.2 | No fix yet |
| GHSA-x2v2-2jhp-c5hv Magento stored cross-site scripting vulnerability |
Medium EPSS 1.41% |
<= 2.0.2 | No fix yet |
| GHSA-8gfq-m4cf-w975 Magento stored cross-site scripting vulnerability in the customer address upload feature |
Medium EPSS 1.70% |
<= 2.0.2 | No fix yet |
| GHSA-94wq-87g6-8h77 Magento Open Source allows Cross-Site Request Forgery (CSRF) |
Medium EPSS 1.62% |
<= 2.0.2 | No fix yet |
| GHSA-cc3w-r3w8-hfh7 Magento Improper Authorization vulnerability in the customers module |
Medium EPSS 0.82% |
<= 2.0.2 | No fix yet |
| GHSA-3x9x-vhqj-cv27 Magento XML Injection vulnerability in the Widgets Update Layout |
High EPSS 3.44% |
<= 2.0.2 | No fix yet |
| GHSA-3f97-7pgv-gmgr Magento affected by a business logic error in the placeOrder graphql mutation |
Medium EPSS 2.04% |
<= 2.0.2 | No fix yet |
| GHSA-xvpx-6hh8-7h72 Magento XML Injection vulnerability in the 'City' field |
High EPSS 2.71% |
<= 2.0.2 | No fix yet |
| GHSA-rhff-65hp-55rw Magento allows attackers to alter the price of items |
High EPSS 2.29% |
<= 2.0.2 | No fix yet |
| GHSA-qmq6-jpvg-j547 Magento is affected by an os command injection via the Data collection endpoint |
High EPSS 2.89% |
<= 2.0.2 | No fix yet |
| GHSA-p746-qw73-qmmx Magento XML Injection vulnerability in the Widgets Module |
Critical EPSS 3.12% |
<= 2.0.2 | No fix yet |
| GHSA-5pjj-7fq8-9gpf Magento has an XML Injection vulnerability |
Critical EPSS 2.89% |
<= 2.0.2 | No fix yet |
| GHSA-5vw8-r55w-f4q4 Magento is affected by an improper input validation vulnerability |
High EPSS 2.24% |
<= 2.0.2 | No fix yet |
| GHSA-gvfx-9m9v-h839 Magento is affected by an improper input validation vulnerability while saving a customer's details |
Critical EPSS 2.81% |
<= 2.0.2 | No fix yet |
| GHSA-7w95-qwhh-q9p3 Magento Path Traversal vulnerability via the `theme[preview_image]` parameter |
High EPSS 3.12% |
<= 2.0.2 | No fix yet |
| GHSA-m8wx-whpp-q283 Magento improper authorization vulnerability |
High EPSS 2.48% |
<= 2.0.2 | No fix yet |
| GHSA-6cwv-wj7v-73xp Magento executes code via the API File Option Upload Extension |
Critical EPSS 2.47% |
<= 2.0.2 | No fix yet |
| GHSA-wgpr-9675-8r67 Magento discloses sensitive information via the Multishipping Module |
Medium EPSS 1.79% |
<= 2.0.2 | No fix yet |
| GHSA-vrq2-w7r7-3fp2 Magento is affected by an improper authorization vulnerability |
Medium EPSS 1.80% |
<= 2.0.2 | No fix yet |
| GHSA-mx5m-j5xr-jg8c Magento vulnerable to file upload attack |
High EPSS 2.41% |
<= 2.0.2 | No fix yet |
| GHSA-j46h-qjjv-cxfj Magento affected by remote code execution via a file upload |
High EPSS 2.41% |
<= 2.0.2 | No fix yet |
| GHSA-2pq5-gpqf-g4r3 Magento has a file extension restrictions bypass |
Critical EPSS 2.87% |
<= 2.0.2 | No fix yet |
| GHSA-36xq-7w8w-xp68 Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension |
High EPSS 1.95% |
<= 2.0.2 | No fix yet |
| GHSA-3g7m-g8qm-x6j5 Magento discloses sensitive information |
Medium EPSS 1.75% |
<= 2.0.2 | No fix yet |
| GHSA-wr57-3h2f-3q95 Magento affected by a server-side denial-of-service using a GraphQL field |
High EPSS 2.01% |
<= 2.0.2 | No fix yet |
| GHSA-39ch-rg26-gmq5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies |
Medium EPSS 1.40% |
<= 2.0.2 | No fix yet |
| GHSA-7gh6-f4jh-3crq Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats |
High EPSS 1.90% |
<= 2.0.2 | No fix yet |
| GHSA-c38m-9668-6j2w Magento Improper input validation vulnerability |
Medium EPSS 1.58% |
<= 2.0.2 | No fix yet |
| GHSA-7gpv-xrjr-f5h4 Magento Path Traversal vulnerability |
Medium EPSS 1.78% |
<= 2.0.2 | No fix yet |
| GHSA-4h3p-63x6-vwg2 Magento Insufficient Session Expiration |
Medium EPSS 1.67% |
<= 2.0.2 | No fix yet |
| GHSA-h5rm-m772-6qcx Magento stored cross-site scripting vulnerability in the admin console |
Medium EPSS 1.61% |
<= 2.0.2 | No fix yet |
| GHSA-4jfq-f8hc-775q Magento Insufficient Session Expiration |
Medium EPSS 1.56% |
<= 2.0.2 | No fix yet |
| GHSA-h4xc-577p-hgj9 Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API |
Medium EPSS 1.66% |
<= 2.0.2 | No fix yet |
| GHSA-crjc-2v9m-8w7r Magento improper authorization vulnerability in the integrations module |
Medium EPSS 1.81% |
<= 2.0.2 | No fix yet |
| GHSA-6988-g89m-27vf Magento stored cross-site scripting (XSS) in the customer address upload feature |
High EPSS 5.62% |
<= 2.0.2 | No fix yet |
| GHSA-8pfq-g48p-x7w8 Magento Insecure Direct Object Reference (IDOR) in the product module |
Medium EPSS 2.20% |
<= 2.0.2 | No fix yet |
| GHSA-269w-pqc7-68q9 Magento vulnerable to a file upload restriction bypass |
Critical EPSS 4.21% |
<= 2.0.2 | No fix yet |
| GHSA-h437-qjj9-vmq4 Magento XPath Injection |
Critical EPSS 3.27% |
<= 2.0.2 | No fix yet |
| GHSA-2j6v-829g-885q Magento Improper Access Control |
Medium EPSS 2.41% |
<= 2.0.2 | No fix yet |
| GHSA-792f-c8mp-2cr5 Magento OS command injection via the WebAPI |
Critical EPSS 4.85% |
<= 2.0.2 | No fix yet |
| GHSA-7pxg-6p87-8c9v Magento 2 Community Edition RCE via Unsafe File Upload |
Critical EPSS 5.27% |
<= 2.0.2 | No fix yet |
| GHSA-hvf5-4jr9-fghh Magento incorrect permissions vulnerability in the Integrations component |
Medium EPSS 1.70% |
<= 2.0.2 | No fix yet |
| GHSA-f2g3-3c6q-4478 Magento 2 Community Edition Incorrect Authorization |
Medium EPSS 2.32% |
<= 2.0.2 | No fix yet |
| GHSA-39rw-4m66-82gf Magento incorrect user permissions vulnerability within the Inventory component |
Low EPSS 1.63% |
<= 2.0.2 | No fix yet |
| GHSA-g7pc-799q-743f Magento DOM-based Cross-site scripting vulnerability |
Critical EPSS 6.02% |
<= 2.0.2 | No fix yet |
| GHSA-fr6f-xmfx-rrpq Magento path traversal vulnerability |
Medium EPSS 4.14% |
<= 2.0.2 | No fix yet |
| GHSA-6w29-x5j4-qhrw Magento security mitigation bypass vulnerability |
Critical EPSS 7.40% |
<= 2.0.2 | No fix yet |
| GHSA-5j4w-v87m-8r65 Magento business logic error vulnerability |
Critical EPSS 3.95% |
<= 2.0.2 | No fix yet |
| GHSA-gffx-9f36-r8wp Magento security mitigation bypass vulnerability |
Critical EPSS 7.40% |
<= 2.0.2 | No fix yet |
| GHSA-55gv-hfg3-hwjq Magento Defense-in-depth security mitigation vulnerability |
Critical EPSS 4.95% |
<= 2.0.2 | No fix yet |
| GHSA-c55h-7q4j-g6rq Magento command injection vulnerability |
Critical EPSS 5.72% |
<= 2.0.2 | No fix yet |
| GHSA-45h4-6gcj-6hwv Magento Stored cross-site scripting |
Medium EPSS 1.17% |
<= 2.0.2 | No fix yet |
| GHSA-c3m4-hxv9-4mxj Magento command injection vulnerability |
Critical EPSS 5.72% |
<= 2.0.2 | No fix yet |
| GHSA-8wm7-h2qh-ff4c Magento authorization bypass vulnerability |
High EPSS 5.01% |
<= 2.0.2 | No fix yet |
| GHSA-j2r4-2cr6-h3r3 Magento Signature verification bypass |
High EPSS 2.92% |
<= 2.0.2 | No fix yet |
| GHSA-4f7x-gjqc-qqpg Magento command injection vulnerability |
Critical EPSS 5.72% |
<= 2.0.2 | No fix yet |
| GHSA-689w-2f93-2x67 Magento stored cross-site scripting vulnerability |
Medium EPSS 1.50% |
<= 2.0.2 | No fix yet |
| GHSA-724x-gqhv-9c5x Magento command injection vulnerability |
Critical EPSS 5.72% |
<= 2.0.2 | No fix yet |
| GHSA-2w2x-7qgj-4x78 Magento stored cross-site scripting vulnerability |
Medium EPSS 1.50% |
<= 2.0.2 | No fix yet |
| GHSA-j2jp-58gv-g2pg Magento Security mitigation bypass vulnerability |
Critical EPSS 5.04% |
<= 2.0.2 | No fix yet |
| GHSA-crv7-r357-gw3w Magento 2 Community Edition RCE Vulnerability |
High EPSS 1.85% |
< 1.9.4.3 | 1.9.4.3 |
| GHSA-h7qw-mxrm-c6h2 Unauthenticated crypto and weak IV in Magento\Framework\Encryption |
High EPSS 0.85% |
>= 2.0, <= 2.0.2 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor