Media
CVE-2026-42458
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 26
Restablecer filtros
Media
CVE-2026-42207
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Crítica
CVE-2026-42155
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Alta
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Media
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Media
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
Alta
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Media
CVE-2026-25523
Magento's X-Original-Url header can expose admin url
Media
CVE-2025-64174
OpenMage vulnerable to XSS in Admin Notifications
Baja
CVE-2025-27400
Magento LTS vulnerable to stored XSS in theme config fields
Media
CVE-2024-41676
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Media
ghsa-gp6m-fq6h-cjcx
Magento LTS vulnerable to stored XSS in admin file form
Alta
ghsa-9j5w-2cqc-cwj9
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
Alta
CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
Alta
CVE-2021-41231
DataFlow upload remote code execution vulnerability
Alta
CVE-2021-41144
Fix for authenticated remote code execution through layout update
Media
CVE-2023-23617
DoS vulnerability in MaliciousCode filter
Alta
CVE-2021-41143
Fix for arbitrary file deletion in customer media allows for remote code execution
Alta
CVE-2021-39217
Fix for arbitrary command execution in custom layout update through blocks
Media
CVE-2021-21395
magento-lts Reset Password not protected against well-timed CSRF
Alta
CVE-2021-32758
Layout XML Arbitrary Code Fix
Alta
CVE-2021-32759
Data Flow Sanitation Issue Fix
Crítica
CVE-2021-21427
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Crítica
CVE-2021-21426
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.