[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fibdgVFHxzIz_zCSIlCOJma5iUrAFS4W5qhFR494LQYw":3},{"product":4,"cycleMajor":13,"releases":14,"cves":78,"nextMajor":2380},{"id":5,"slug":6,"name":7,"category":8,"vendor":9,"description":10,"logo_url":9,"official_url":9,"synced_at":11,"created_at":12},"4b7630e3-6988-417a-aff1-7f965071ad6b","magento","Magento","other",null,"Developers rely on Magento to build and manage their e-commerce platforms, and understanding the lifecycle of this software is crucial for maintaining security and compatibility. Created to solve the complex problem of online store management, Magento has been a staple in the industry, with its development and maintenance overseen by Adobe. The community of developers using Magento is vast and active, with many choosing the platform for its flexibility and customization options. Since its inception, Magento has undergone numerous updates, resulting in a total of 24 versions, each with its own set of features and security considerations.\n\nThe end-of-life landscape for Magento is complex, with 20 versions having reached the end of their support cycle, leaving only 4 active versions currently supported. The latest stable version, 2.4.9, is the recommended version for new installations and upgrades. Although there is no next scheduled end-of-life date announced, the most recent version to reach end-of-life was 2.4.5, which occurred on 2024-11-25. This highlights the importance of staying informed about the lifecycle of each Magento version to plan upgrades and ensure the security of online platforms. By tracking the end-of-life dates and supported versions, developers can avoid using outdated software that may expose their applications to security risks.\n\nThe security picture for Magento is a concern, with a total of 1000 tracked CVEs, including 169 critical vulnerabilities. Version 2.3 is the most affected, with 268 CVEs, making it a priority for developers to upgrade from this version as soon as possible. The high number of critical CVEs underscores the need for developers to stay vigilant and apply security patches in a timely manner. To mitigate these risks, developers should regularly review the security patch timelines and plan their upgrades accordingly, ensuring they are always running a supported version of Magento to protect their applications from potential security threats.","2026-09-05T02:00:13.827+00:00","2026-05-30T16:23:55.904463+00:00","1",[15,23,29,35,41,47,52,59,66,73],{"id":16,"product_id":5,"cycle":17,"release_date":18,"eol":19,"eol_boolean":9,"latest":20,"latest_release_date":9,"lts":21,"support":19,"created_at":22},"0e70bd07-fa2b-436b-af95-dc4dbac045b3","1.9","2014-05-01","2020-06-01","1.9.4.3",false,"2026-05-30T16:35:27.63636+00:00",{"id":24,"product_id":5,"cycle":25,"release_date":26,"eol":19,"eol_boolean":9,"latest":27,"latest_release_date":9,"lts":21,"support":28,"created_at":22},"8308e8f3-d9a3-4f38-9db3-281cffc066a0","1.8","2013-09-01","1.8.1.0","2014-09-01",{"id":30,"product_id":5,"cycle":31,"release_date":32,"eol":19,"eol_boolean":9,"latest":33,"latest_release_date":9,"lts":21,"support":34,"created_at":22},"68686839-22d5-4bde-8032-7bbc10d367b8","1.7","2012-04-01","1.7.0.2","2013-04-01",{"id":36,"product_id":5,"cycle":37,"release_date":38,"eol":19,"eol_boolean":9,"latest":39,"latest_release_date":9,"lts":21,"support":40,"created_at":22},"5b63c048-d7be-4409-97ff-c5cea8a03a4b","1.6","2011-08-01","1.6.2.0","2012-08-01",{"id":42,"product_id":5,"cycle":43,"release_date":44,"eol":19,"eol_boolean":9,"latest":45,"latest_release_date":9,"lts":21,"support":46,"created_at":22},"ba7d43db-a91d-4c69-88b0-db46199e4885","1.5","2011-02-01","1.5.1.0","2012-02-01",{"id":48,"product_id":5,"cycle":49,"release_date":50,"eol":46,"eol_boolean":9,"latest":51,"latest_release_date":9,"lts":21,"support":44,"created_at":22},"43ed8971-07a0-4913-981d-30a39645d5d8","1.4","2010-02-01","1.4.2.0",{"id":53,"product_id":5,"cycle":54,"release_date":55,"eol":56,"eol_boolean":9,"latest":57,"latest_release_date":9,"lts":21,"support":58,"created_at":22},"81112722-2593-4311-8a83-d2efd6fea453","1.3","2009-03-01","2011-03-01","1.3.3.0","2010-03-01",{"id":60,"product_id":5,"cycle":61,"release_date":62,"eol":63,"eol_boolean":9,"latest":64,"latest_release_date":9,"lts":21,"support":65,"created_at":22},"c30fc9f0-a581-4563-96e5-17255d837fb4","1.2","2008-12-01","2010-12-01","1.2.1.2","2009-12-01",{"id":67,"product_id":5,"cycle":68,"release_date":69,"eol":70,"eol_boolean":9,"latest":71,"latest_release_date":9,"lts":21,"support":72,"created_at":22},"54cd9db8-636e-4532-92ef-1e93eee9703e","1.1","2008-07-01","2010-07-01","1.1.8","2009-07-01",{"id":74,"product_id":5,"cycle":75,"release_date":76,"eol":58,"eol_boolean":9,"latest":77,"latest_release_date":9,"lts":21,"support":55,"created_at":22},"2f5399fc-bb58-4069-9af9-2f833992d292","1.0","2008-03-01","1.0.0",[79,87,88,89,90,91,92,93,94,95,96,104,105,106,107,108,109,110,111,112,113,120,121,122,123,124,125,126,127,128,129,134,135,136,137,138,139,140,141,142,143,150,151,152,153,154,155,156,157,158,159,167,168,169,170,171,172,173,174,175,176,182,183,184,185,186,187,188,189,190,191,197,198,199,200,201,202,203,204,205,206,211,212,213,214,215,216,217,218,219,220,225,226,227,228,229,230,231,232,233,234,239,240,241,242,243,244,245,246,247,248,255,256,257,258,259,260,261,262,263,264,270,271,272,273,274,275,276,277,278,279,284,285,286,287,288,289,290,291,292,293,300,301,302,303,304,305,306,307,308,309,316,317,318,319,320,321,322,323,324,325,332,333,334,335,336,337,338,339,340,341,348,349,350,351,352,353,354,355,356,357,363,364,365,366,367,368,369,370,371,372,379,380,381,382,383,384,385,386,387,388,395,396,397,398,399,400,401,402,403,404,411,412,413,414,415,416,417,418,419,420,426,427,428,429,430,431,432,433,434,435,441,442,443,444,445,446,447,448,449,450,456,457,458,459,460,461,462,463,464,465,471,472,473,474,475,476,477,478,479,480,487,488,489,490,491,492,493,494,495,496,503,504,505,506,507,508,509,510,511,512,517,518,519,520,521,522,523,524,525,526,532,533,534,535,536,537,538,539,540,541,547,548,549,550,551,552,553,554,555,556,562,563,564,565,566,567,568,569,570,571,576,577,578,579,580,581,582,583,584,585,591,592,593,594,595,596,597,598,599,600,604,605,606,607,608,609,610,611,612,613,618,619,620,621,622,623,624,625,626,627,633,634,635,636,637,638,639,640,641,642,648,649,650,651,652,653,654,655,656,657,663,664,665,666,667,668,669,670,671,672,679,680,681,682,683,684,685,686,687,688,694,695,696,697,698,699,700,701,702,703,710,711,712,713,714,715,716,717,718,719,727,728,729,730,731,732,733,734,735,736,742,743,744,745,746,747,748,749,750,751,757,758,759,760,761,762,763,764,765,766,773,774,775,776,777,778,779,780,781,782,789,790,791,792,793,794,795,796,797,798,805,806,807,808,809,810,811,812,813,814,820,821,822,823,824,825,826,827,828,829,835,836,837,838,839,840,841,842,843,844,850,851,852,853,854,855,856,857,858,859,865,866,867,868,869,870,871,872,873,874,880,881,882,883,884,885,886,887,888,889,895,896,897,898,899,900,901,902,903,904,911,912,913,914,915,916,917,918,919,920,926,927,928,929,930,931,932,933,934,935,942,943,944,945,946,947,948,949,950,951,957,958,959,960,961,962,963,964,965,966,973,974,975,976,977,978,979,980,981,982,988,989,990,991,992,993,994,995,996,997,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1018,1019,1020,1021,1022,1023,1024,1025,1026,1027,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1198,1199,1200,1201,1202,1203,1204,1205,1206,1207,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1228,1229,1230,1231,1232,1233,1234,1235,1236,1237,1243,1244,1245,1246,1247,1248,1249,1250,1251,1252,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1288,1289,1290,1291,1292,1293,1294,1295,1296,1297,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1334,1335,1336,1337,1338,1339,1340,1341,1342,1343,1349,1350,1351,1352,1353,1354,1355,1356,1357,1358,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1395,1396,1397,1398,1399,1400,1401,1402,1403,1404,1411,1412,1413,1414,1415,1416,1417,1418,1419,1420,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435,1442,1443,1444,1445,1446,1447,1448,1449,1450,1451,1457,1458,1459,1460,1461,1462,1463,1464,1465,1466,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1501,1502,1503,1504,1505,1506,1507,1508,1509,1510,1516,1517,1518,1519,1520,1521,1522,1523,1524,1525,1529,1530,1531,1532,1533,1534,1535,1536,1537,1538,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1574,1575,1576,1577,1578,1579,1580,1581,1582,1583,1589,1590,1591,1592,1593,1594,1595,1596,1597,1598,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1634,1635,1636,1637,1638,1639,1640,1641,1642,1643,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1675,1676,1677,1678,1679,1680,1681,1682,1683,1684,1688,1689,1690,1691,1692,1693,1694,1695,1696,1697,1701,1702,1703,1704,1705,1706,1707,1708,1709,1710,1715,1716,1717,1718,1719,1720,1721,1722,1723,1724,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1743,1744,1745,1746,1747,1748,1749,1750,1756,1757,1758,1759,1760,1761,1762,1763,1764,1765,1771,1772,1773,1774,1775,1776,1777,1778,1779,1780,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1800,1801,1802,1803,1804,1805,1806,1807,1808,1809,1815,1816,1817,1818,1819,1820,1821,1822,1823,1824,1828,1829,1830,1831,1832,1833,1834,1835,1836,1837,1843,1844,1845,1846,1847,1848,1849,1850,1851,1852,1859,1860,1861,1862,1863,1869,1870,1871,1872,1873,1878,1879,1880,1881,1882,1887,1888,1889,1890,1891,1897,1898,1899,1900,1901,1906,1907,1908,1909,1910,1916,1917,1918,1919,1920,1926,1927,1928,1929,1930,1936,1937,1938,1939,1940,1946,1947,1948,1949,1950,1951,1952,1953,1954,1955,1961,1962,1963,1964,1965,1966,1967,1968,1969,1970,1975,1976,1977,1978,1979,1985,1986,1987,1988,1989,1990,1991,1992,1993,1994,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2014,2015,2016,2017,2018,2019,2020,2021,2022,2023,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2057,2058,2059,2060,2061,2062,2063,2064,2065,2066,2071,2072,2073,2074,2075,2076,2077,2078,2079,2080,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2158,2159,2160,2161,2162,2163,2164,2165,2166,2167,2172,2173,2174,2175,2176,2177,2178,2179,2180,2181,2186,2187,2188,2189,2190,2191,2192,2193,2194,2195,2200,2201,2202,2203,2204,2205,2206,2207,2208,2209,2215,2216,2217,2218,2219,2220,2221,2222,2223,2224,2230,2231,2232,2233,2234,2235,2236,2237,2238,2239,2245,2246,2247,2248,2249,2250,2251,2252,2253,2254,2260,2261,2262,2263,2264,2265,2266,2267,2268,2269,2275,2276,2277,2278,2279,2280,2281,2282,2283,2284,2290,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2311,2312,2313,2314,2315,2316,2317,2318,2319,2320,2326,2327,2328,2329,2330,2331,2332,2333,2334,2335,2341,2348,2354,2360,2366,2373,2374],{"cveId":80,"releaseId":60,"cycle":61,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},"CVE-2026-34685","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier [NEEDS REVIEW: impact mismatch — ticket says 'Arbitrary file system write', CIA triad derives 'Security Feature Bypass'. Verify CVSS vector before publishing.] are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit","LOW",3.4,0.00373,"2026-05-12T20:16:38.48+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34685",{"cveId":80,"releaseId":74,"cycle":75,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":16,"cycle":17,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":67,"cycle":68,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":24,"cycle":25,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":30,"cycle":31,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":48,"cycle":49,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":53,"cycle":54,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":42,"cycle":43,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":80,"releaseId":36,"cycle":37,"description":81,"severity":82,"cvssScore":83,"epssScore":84,"inKev":21,"publishedAt":85,"url":86},{"cveId":97,"releaseId":30,"cycle":31,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},"CVE-2026-34658","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.","MEDIUM",4.8,0.00274,"2026-05-12T20:16:36.833+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34658",{"cveId":97,"releaseId":74,"cycle":75,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":53,"cycle":54,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":48,"cycle":49,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":42,"cycle":43,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":36,"cycle":37,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":24,"cycle":25,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":16,"cycle":17,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":67,"cycle":68,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":97,"releaseId":60,"cycle":61,"description":98,"severity":99,"cvssScore":100,"epssScore":101,"inKev":21,"publishedAt":102,"url":103},{"cveId":114,"releaseId":53,"cycle":54,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},"CVE-2026-34656","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.",4.3,0.00393,"2026-05-12T20:16:36.72+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34656",{"cveId":114,"releaseId":48,"cycle":49,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":42,"cycle":43,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":36,"cycle":37,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":30,"cycle":31,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":24,"cycle":25,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":16,"cycle":17,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":74,"cycle":75,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":67,"cycle":68,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":114,"releaseId":60,"cycle":61,"description":115,"severity":99,"cvssScore":116,"epssScore":117,"inKev":21,"publishedAt":118,"url":119},{"cveId":130,"releaseId":24,"cycle":25,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},"CVE-2026-34655",0.00368,"2026-05-12T20:16:36.607+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34655",{"cveId":130,"releaseId":53,"cycle":54,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":48,"cycle":49,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":42,"cycle":43,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":36,"cycle":37,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":30,"cycle":31,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":16,"cycle":17,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":74,"cycle":75,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":67,"cycle":68,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":130,"releaseId":60,"cycle":61,"description":98,"severity":99,"cvssScore":100,"epssScore":131,"inKev":21,"publishedAt":132,"url":133},{"cveId":144,"releaseId":53,"cycle":54,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},"CVE-2026-34654","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.",5.3,0.0062,"2026-05-12T20:16:36.5+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34654",{"cveId":144,"releaseId":48,"cycle":49,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":42,"cycle":43,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":36,"cycle":37,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":30,"cycle":31,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":24,"cycle":25,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":16,"cycle":17,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":74,"cycle":75,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":67,"cycle":68,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":144,"releaseId":60,"cycle":61,"description":145,"severity":99,"cvssScore":146,"epssScore":147,"inKev":21,"publishedAt":148,"url":149},{"cveId":160,"releaseId":53,"cycle":54,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},"CVE-2026-34653","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.","HIGH",8.7,0.00606,"2026-05-12T20:16:36.387+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34653",{"cveId":160,"releaseId":48,"cycle":49,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":42,"cycle":43,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":36,"cycle":37,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":30,"cycle":31,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":24,"cycle":25,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":16,"cycle":17,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":74,"cycle":75,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":67,"cycle":68,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":160,"releaseId":60,"cycle":61,"description":161,"severity":162,"cvssScore":163,"epssScore":164,"inKev":21,"publishedAt":165,"url":166},{"cveId":177,"releaseId":53,"cycle":54,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},"CVE-2026-34652",7.5,0.00508,"2026-05-12T20:16:36.273+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34652",{"cveId":177,"releaseId":48,"cycle":49,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":42,"cycle":43,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":36,"cycle":37,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":30,"cycle":31,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":24,"cycle":25,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":16,"cycle":17,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":74,"cycle":75,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":67,"cycle":68,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":177,"releaseId":60,"cycle":61,"description":145,"severity":162,"cvssScore":178,"epssScore":179,"inKev":21,"publishedAt":180,"url":181},{"cveId":192,"releaseId":53,"cycle":54,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},"CVE-2026-34651","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.",0.00675,"2026-05-12T20:16:36.15+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34651",{"cveId":192,"releaseId":48,"cycle":49,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":42,"cycle":43,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":36,"cycle":37,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":30,"cycle":31,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":24,"cycle":25,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":16,"cycle":17,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":74,"cycle":75,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":67,"cycle":68,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":192,"releaseId":60,"cycle":61,"description":193,"severity":162,"cvssScore":178,"epssScore":194,"inKev":21,"publishedAt":195,"url":196},{"cveId":207,"releaseId":36,"cycle":37,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},"CVE-2026-34650",0.15933,"2026-05-12T20:16:36.033+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34650",{"cveId":207,"releaseId":30,"cycle":31,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":24,"cycle":25,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":16,"cycle":17,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":74,"cycle":75,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":67,"cycle":68,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":60,"cycle":61,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":53,"cycle":54,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":48,"cycle":49,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":207,"releaseId":42,"cycle":43,"description":193,"severity":162,"cvssScore":178,"epssScore":208,"inKev":21,"publishedAt":209,"url":210},{"cveId":221,"releaseId":53,"cycle":54,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},"CVE-2026-34649",0.14383,"2026-05-12T20:16:35.917+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34649",{"cveId":221,"releaseId":48,"cycle":49,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":42,"cycle":43,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":36,"cycle":37,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":30,"cycle":31,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":24,"cycle":25,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":16,"cycle":17,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":74,"cycle":75,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":67,"cycle":68,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":221,"releaseId":60,"cycle":61,"description":193,"severity":162,"cvssScore":178,"epssScore":222,"inKev":21,"publishedAt":223,"url":224},{"cveId":235,"releaseId":53,"cycle":54,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},"CVE-2026-34648",0.2255,"2026-05-12T20:16:35.797+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34648",{"cveId":235,"releaseId":48,"cycle":49,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":30,"cycle":31,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":24,"cycle":25,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":16,"cycle":17,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":74,"cycle":75,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":67,"cycle":68,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":60,"cycle":61,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":36,"cycle":37,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":235,"releaseId":42,"cycle":43,"description":193,"severity":162,"cvssScore":178,"epssScore":236,"inKev":21,"publishedAt":237,"url":238},{"cveId":249,"releaseId":60,"cycle":61,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},"CVE-2026-34647","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.",7.4,0.00654,"2026-05-12T20:16:35.677+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34647",{"cveId":249,"releaseId":53,"cycle":54,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":48,"cycle":49,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":42,"cycle":43,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":36,"cycle":37,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":30,"cycle":31,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":24,"cycle":25,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":16,"cycle":17,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":74,"cycle":75,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":249,"releaseId":67,"cycle":68,"description":250,"severity":162,"cvssScore":251,"epssScore":252,"inKev":21,"publishedAt":253,"url":254},{"cveId":265,"releaseId":24,"cycle":25,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},"CVE-2026-34646","Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.",0.00411,"2026-05-12T20:16:35.56+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34646",{"cveId":265,"releaseId":16,"cycle":17,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":74,"cycle":75,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":67,"cycle":68,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":60,"cycle":61,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":36,"cycle":37,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":48,"cycle":49,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":53,"cycle":54,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":30,"cycle":31,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":265,"releaseId":42,"cycle":43,"description":266,"severity":162,"cvssScore":178,"epssScore":267,"inKev":21,"publishedAt":268,"url":269},{"cveId":280,"releaseId":67,"cycle":68,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},"CVE-2026-34645",0.00561,"2026-05-12T20:16:35.423+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34645",{"cveId":280,"releaseId":53,"cycle":54,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":48,"cycle":49,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":42,"cycle":43,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":36,"cycle":37,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":30,"cycle":31,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":24,"cycle":25,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":16,"cycle":17,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":60,"cycle":61,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":280,"releaseId":74,"cycle":75,"description":266,"severity":162,"cvssScore":178,"epssScore":281,"inKev":21,"publishedAt":282,"url":283},{"cveId":294,"releaseId":74,"cycle":75,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},"CVE-2026-40488","Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, ",8.8,0.00691,"2026-04-20T17:16:36.3+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40488",{"cveId":294,"releaseId":24,"cycle":25,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":30,"cycle":31,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":36,"cycle":37,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":42,"cycle":43,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":48,"cycle":49,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":53,"cycle":54,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":16,"cycle":17,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":67,"cycle":68,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":294,"releaseId":60,"cycle":61,"description":295,"severity":162,"cvssScore":296,"epssScore":297,"inKev":21,"publishedAt":298,"url":299},{"cveId":310,"releaseId":30,"cycle":31,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},"CVE-2026-40098","Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker ",5.4,0.00176,"2026-04-20T17:16:34.543+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40098",{"cveId":310,"releaseId":24,"cycle":25,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":16,"cycle":17,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":74,"cycle":75,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":67,"cycle":68,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":60,"cycle":61,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":36,"cycle":37,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":53,"cycle":54,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":42,"cycle":43,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":310,"releaseId":48,"cycle":49,"description":311,"severity":99,"cvssScore":312,"epssScore":313,"inKev":21,"publishedAt":314,"url":315},{"cveId":326,"releaseId":36,"cycle":37,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},"CVE-2026-25525","Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('..\u002F', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `...\u002F.\u002F` or `....\u002F\u002F`, which after the replacement still result in `..\u002F`. An authenticated admi",4.9,0.00502,"2026-04-20T17:16:32.46+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25525",{"cveId":326,"releaseId":24,"cycle":25,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":16,"cycle":17,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":74,"cycle":75,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":67,"cycle":68,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":60,"cycle":61,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":53,"cycle":54,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":48,"cycle":49,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":42,"cycle":43,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":326,"releaseId":30,"cycle":31,"description":327,"severity":99,"cvssScore":328,"epssScore":329,"inKev":21,"publishedAt":330,"url":331},{"cveId":342,"releaseId":67,"cycle":68,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},"CVE-2026-25524","Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar:\u002F\u002F` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An at",8.1,0.00539,"2026-04-20T17:16:32.29+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25524",{"cveId":342,"releaseId":16,"cycle":17,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":24,"cycle":25,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":30,"cycle":31,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":36,"cycle":37,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":42,"cycle":43,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":53,"cycle":54,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":48,"cycle":49,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":60,"cycle":61,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":342,"releaseId":74,"cycle":75,"description":343,"severity":162,"cvssScore":344,"epssScore":345,"inKev":21,"publishedAt":346,"url":347},{"cveId":358,"releaseId":42,"cycle":43,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},"CVE-2026-21361","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and ",0.00445,"2026-03-11T03:15:56.033+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21361",{"cveId":358,"releaseId":30,"cycle":31,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":24,"cycle":25,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":53,"cycle":54,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":60,"cycle":61,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":67,"cycle":68,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":74,"cycle":75,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":16,"cycle":17,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":48,"cycle":49,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":358,"releaseId":36,"cycle":37,"description":359,"severity":162,"cvssScore":344,"epssScore":360,"inKev":21,"publishedAt":361,"url":362},{"cveId":373,"releaseId":48,"cycle":49,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},"CVE-2026-21360","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted path. Exploitation of this issue does not require user interaction.",6.8,0.00636,"2026-03-11T03:15:55.867+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21360",{"cveId":373,"releaseId":60,"cycle":61,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":42,"cycle":43,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":36,"cycle":37,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":30,"cycle":31,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":24,"cycle":25,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":16,"cycle":17,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":74,"cycle":75,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":67,"cycle":68,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":373,"releaseId":53,"cycle":54,"description":374,"severity":99,"cvssScore":375,"epssScore":376,"inKev":21,"publishedAt":377,"url":378},{"cveId":389,"releaseId":53,"cycle":54,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},"CVE-2026-21359","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.",4.7,0.00211,"2026-03-11T03:15:55.693+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21359",{"cveId":389,"releaseId":60,"cycle":61,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":67,"cycle":68,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":74,"cycle":75,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":16,"cycle":17,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":24,"cycle":25,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":30,"cycle":31,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":36,"cycle":37,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":42,"cycle":43,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":389,"releaseId":48,"cycle":49,"description":390,"severity":99,"cvssScore":391,"epssScore":392,"inKev":21,"publishedAt":393,"url":394},{"cveId":405,"releaseId":60,"cycle":61,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},"CVE-2026-21311","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and i",8,0.00304,"2026-03-11T03:15:55.51+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21311",{"cveId":405,"releaseId":67,"cycle":68,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":74,"cycle":75,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":16,"cycle":17,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":24,"cycle":25,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":30,"cycle":31,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":36,"cycle":37,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":42,"cycle":43,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":48,"cycle":49,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":405,"releaseId":53,"cycle":54,"description":406,"severity":162,"cvssScore":407,"epssScore":408,"inKev":21,"publishedAt":409,"url":410},{"cveId":421,"releaseId":53,"cycle":54,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},"CVE-2026-21310","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation of this issue does not require user interaction.",0.00302,"2026-03-11T03:15:55.33+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21310",{"cveId":421,"releaseId":48,"cycle":49,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":42,"cycle":43,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":36,"cycle":37,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":30,"cycle":31,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":24,"cycle":25,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":16,"cycle":17,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":74,"cycle":75,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":67,"cycle":68,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":421,"releaseId":60,"cycle":61,"description":422,"severity":99,"cvssScore":146,"epssScore":423,"inKev":21,"publishedAt":424,"url":425},{"cveId":436,"releaseId":16,"cycle":17,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},"CVE-2026-21309","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.",0.0056,"2026-03-11T03:15:55.163+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21309",{"cveId":436,"releaseId":42,"cycle":43,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":48,"cycle":49,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":53,"cycle":54,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":36,"cycle":37,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":30,"cycle":31,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":24,"cycle":25,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":60,"cycle":61,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":67,"cycle":68,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":436,"releaseId":74,"cycle":75,"description":437,"severity":162,"cvssScore":178,"epssScore":438,"inKev":21,"publishedAt":439,"url":440},{"cveId":451,"releaseId":67,"cycle":68,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},"CVE-2026-21297","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction.",0.0035,"2026-03-11T03:15:54.99+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21297",{"cveId":451,"releaseId":60,"cycle":61,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":53,"cycle":54,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":48,"cycle":49,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":42,"cycle":43,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":36,"cycle":37,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":30,"cycle":31,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":24,"cycle":25,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":16,"cycle":17,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":451,"releaseId":74,"cycle":75,"description":452,"severity":99,"cvssScore":116,"epssScore":453,"inKev":21,"publishedAt":454,"url":455},{"cveId":466,"releaseId":24,"cycle":25,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},"CVE-2026-21296","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.",0.00339,"2026-03-11T03:15:54.82+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21296",{"cveId":466,"releaseId":30,"cycle":31,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":36,"cycle":37,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":42,"cycle":43,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":48,"cycle":49,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":53,"cycle":54,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":60,"cycle":61,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":67,"cycle":68,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":74,"cycle":75,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":466,"releaseId":16,"cycle":17,"description":467,"severity":99,"cvssScore":116,"epssScore":468,"inKev":21,"publishedAt":469,"url":470},{"cveId":481,"releaseId":67,"cycle":68,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},"CVE-2026-21295","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.",3.1,0.00233,"2026-03-11T03:15:54.653+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21295",{"cveId":481,"releaseId":30,"cycle":31,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":36,"cycle":37,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":42,"cycle":43,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":48,"cycle":49,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":53,"cycle":54,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":60,"cycle":61,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":24,"cycle":25,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":16,"cycle":17,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":481,"releaseId":74,"cycle":75,"description":482,"severity":82,"cvssScore":483,"epssScore":484,"inKev":21,"publishedAt":485,"url":486},{"cveId":497,"releaseId":48,"cycle":49,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},"CVE-2026-21294","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation of this issue does not require user interaction.",5.5,0.00243,"2026-03-11T03:15:54.46+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21294",{"cveId":497,"releaseId":74,"cycle":75,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":67,"cycle":68,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":60,"cycle":61,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":16,"cycle":17,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":24,"cycle":25,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":30,"cycle":31,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":36,"cycle":37,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":42,"cycle":43,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":497,"releaseId":53,"cycle":54,"description":498,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":501,"url":502},{"cveId":513,"releaseId":16,"cycle":17,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},"CVE-2026-21293","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation of this issue does not require user interaction.","2026-03-11T03:15:54.287+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21293",{"cveId":513,"releaseId":60,"cycle":61,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":67,"cycle":68,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":74,"cycle":75,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":42,"cycle":43,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":48,"cycle":49,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":53,"cycle":54,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":36,"cycle":37,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":30,"cycle":31,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":513,"releaseId":24,"cycle":25,"description":514,"severity":99,"cvssScore":499,"epssScore":500,"inKev":21,"publishedAt":515,"url":516},{"cveId":527,"releaseId":36,"cycle":37,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},"CVE-2026-21292","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.",0.00255,"2026-03-11T03:15:54.123+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21292",{"cveId":527,"releaseId":42,"cycle":43,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":48,"cycle":49,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":53,"cycle":54,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":60,"cycle":61,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":67,"cycle":68,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":74,"cycle":75,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":16,"cycle":17,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":24,"cycle":25,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":527,"releaseId":30,"cycle":31,"description":528,"severity":99,"cvssScore":312,"epssScore":529,"inKev":21,"publishedAt":530,"url":531},{"cveId":542,"releaseId":30,"cycle":31,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},"CVE-2026-21291","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.",0.00267,"2026-03-11T03:15:53.943+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21291",{"cveId":542,"releaseId":53,"cycle":54,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":48,"cycle":49,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":42,"cycle":43,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":36,"cycle":37,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":24,"cycle":25,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":16,"cycle":17,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":74,"cycle":75,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":67,"cycle":68,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":542,"releaseId":60,"cycle":61,"description":543,"severity":99,"cvssScore":100,"epssScore":544,"inKev":21,"publishedAt":545,"url":546},{"cveId":557,"releaseId":60,"cycle":61,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},"CVE-2026-21290","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and in",0.00452,"2026-03-11T03:15:53.773+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21290",{"cveId":557,"releaseId":53,"cycle":54,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":48,"cycle":49,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":42,"cycle":43,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":36,"cycle":37,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":30,"cycle":31,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":24,"cycle":25,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":16,"cycle":17,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":74,"cycle":75,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":557,"releaseId":67,"cycle":68,"description":558,"severity":162,"cvssScore":163,"epssScore":559,"inKev":21,"publishedAt":560,"url":561},{"cveId":572,"releaseId":67,"cycle":68,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},"CVE-2026-21289",0.00603,"2026-03-11T03:15:53.6+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21289",{"cveId":572,"releaseId":53,"cycle":54,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":48,"cycle":49,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":42,"cycle":43,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":36,"cycle":37,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":30,"cycle":31,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":24,"cycle":25,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":16,"cycle":17,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":74,"cycle":75,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":572,"releaseId":60,"cycle":61,"description":437,"severity":162,"cvssScore":178,"epssScore":573,"inKev":21,"publishedAt":574,"url":575},{"cveId":586,"releaseId":16,"cycle":17,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},"CVE-2026-21286","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.",0.00295,"2026-03-11T03:15:53.417+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21286",{"cveId":586,"releaseId":60,"cycle":61,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":67,"cycle":68,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":74,"cycle":75,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":24,"cycle":25,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":30,"cycle":31,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":36,"cycle":37,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":42,"cycle":43,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":48,"cycle":49,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":586,"releaseId":53,"cycle":54,"description":587,"severity":99,"cvssScore":146,"epssScore":588,"inKev":21,"publishedAt":589,"url":590},{"cveId":601,"releaseId":48,"cycle":49,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},"CVE-2026-21285","2026-03-11T03:15:53.23+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21285",{"cveId":601,"releaseId":53,"cycle":54,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":60,"cycle":61,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":67,"cycle":68,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":74,"cycle":75,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":16,"cycle":17,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":24,"cycle":25,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":30,"cycle":31,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":36,"cycle":37,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":601,"releaseId":42,"cycle":43,"description":452,"severity":99,"cvssScore":116,"epssScore":529,"inKev":21,"publishedAt":602,"url":603},{"cveId":614,"releaseId":74,"cycle":75,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},"CVE-2026-21284",0.00382,"2026-03-11T03:15:53.04+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21284",{"cveId":614,"releaseId":67,"cycle":68,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":60,"cycle":61,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":53,"cycle":54,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":48,"cycle":49,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":42,"cycle":43,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":36,"cycle":37,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":30,"cycle":31,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":24,"cycle":25,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":614,"releaseId":16,"cycle":17,"description":406,"severity":162,"cvssScore":344,"epssScore":615,"inKev":21,"publishedAt":616,"url":617},{"cveId":628,"releaseId":74,"cycle":75,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},"CVE-2026-21282","Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing limited impact to application availability. Exploitation of this issue does not require user interaction.",0.00524,"2026-03-11T03:15:52.597+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21282",{"cveId":628,"releaseId":16,"cycle":17,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":53,"cycle":54,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":48,"cycle":49,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":42,"cycle":43,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":24,"cycle":25,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":36,"cycle":37,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":30,"cycle":31,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":60,"cycle":61,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":628,"releaseId":67,"cycle":68,"description":629,"severity":99,"cvssScore":146,"epssScore":630,"inKev":21,"publishedAt":631,"url":632},{"cveId":643,"releaseId":74,"cycle":75,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},"CVE-2026-25523","Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.",0.003,"2026-02-04T22:15:59.353+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25523",{"cveId":643,"releaseId":24,"cycle":25,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":16,"cycle":17,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":67,"cycle":68,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":60,"cycle":61,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":53,"cycle":54,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":48,"cycle":49,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":42,"cycle":43,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":36,"cycle":37,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":643,"releaseId":30,"cycle":31,"description":644,"severity":99,"cvssScore":146,"epssScore":645,"inKev":21,"publishedAt":646,"url":647},{"cveId":658,"releaseId":42,"cycle":43,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},"CVE-2025-64174","Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app\u002Fcode\u002Fcore\u002FMage\u002FAdminhtml\u002FBlock\u002FNotification\u002FGrid\u002FRenderer\u002FActions.php. A malicious translation or ",0.00221,"2025-11-06T21:15:43.81+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-64174",{"cveId":658,"releaseId":53,"cycle":54,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":48,"cycle":49,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":36,"cycle":37,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":30,"cycle":31,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":24,"cycle":25,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":16,"cycle":17,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":74,"cycle":75,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":67,"cycle":68,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":658,"releaseId":60,"cycle":61,"description":659,"severity":99,"cvssScore":100,"epssScore":660,"inKev":21,"publishedAt":661,"url":662},{"cveId":673,"releaseId":53,"cycle":54,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},"CVE-2024-41676","Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design\u002Fheader\u002Fwelcome, design\u002Fheader\u002Flogo_src, design\u002Fheader\u002Flogo_src_small, and design\u002Fheader\u002Flogo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases.\nBut because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched",4.1,0.00361,"2024-07-29T15:15:16.04+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-41676",{"cveId":673,"releaseId":67,"cycle":68,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":60,"cycle":61,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":74,"cycle":75,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":36,"cycle":37,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":16,"cycle":17,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":30,"cycle":31,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":42,"cycle":43,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":48,"cycle":49,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":673,"releaseId":24,"cycle":25,"description":674,"severity":99,"cvssScore":675,"epssScore":676,"inKev":21,"publishedAt":677,"url":678},{"cveId":689,"releaseId":74,"cycle":75,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},"CVE-2023-41879","Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a \"guest-view\" cookie which contains the order's \"protect_code\". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.",0.00823,"2023-09-11T22:15:08.267+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-41879",{"cveId":689,"releaseId":67,"cycle":68,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":60,"cycle":61,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":53,"cycle":54,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":48,"cycle":49,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":16,"cycle":17,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":42,"cycle":43,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":36,"cycle":37,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":30,"cycle":31,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":689,"releaseId":24,"cycle":25,"description":690,"severity":162,"cvssScore":178,"epssScore":691,"inKev":21,"publishedAt":692,"url":693},{"cveId":704,"releaseId":48,"cycle":49,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},"CVE-2021-36036","Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.",7.2,0.0205,"2023-09-06T14:15:09.11+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-36036",{"cveId":704,"releaseId":36,"cycle":37,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":53,"cycle":54,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":42,"cycle":43,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":30,"cycle":31,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":24,"cycle":25,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":16,"cycle":17,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":74,"cycle":75,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":67,"cycle":68,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":704,"releaseId":60,"cycle":61,"description":705,"severity":162,"cvssScore":706,"epssScore":707,"inKev":21,"publishedAt":708,"url":709},{"cveId":720,"releaseId":24,"cycle":25,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},"CVE-2021-36023","Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.","CRITICAL",9.1,0.02292,"2023-09-06T14:15:08.95+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-36023",{"cveId":720,"releaseId":30,"cycle":31,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":60,"cycle":61,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":36,"cycle":37,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":42,"cycle":43,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":48,"cycle":49,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":53,"cycle":54,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":16,"cycle":17,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":67,"cycle":68,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":720,"releaseId":74,"cycle":75,"description":721,"severity":722,"cvssScore":723,"epssScore":724,"inKev":21,"publishedAt":725,"url":726},{"cveId":737,"releaseId":16,"cycle":17,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},"CVE-2021-36021","Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system. ",0.01949,"2023-09-06T14:15:08.767+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-36021",{"cveId":737,"releaseId":74,"cycle":75,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":67,"cycle":68,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":60,"cycle":61,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":53,"cycle":54,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":48,"cycle":49,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":42,"cycle":43,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":36,"cycle":37,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":30,"cycle":31,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":737,"releaseId":24,"cycle":25,"description":738,"severity":162,"cvssScore":706,"epssScore":739,"inKev":21,"publishedAt":740,"url":741},{"cveId":752,"releaseId":74,"cycle":75,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},"CVE-2021-41143","OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.\n\n",0.01293,"2023-01-27T19:15:09.377+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-41143",{"cveId":752,"releaseId":53,"cycle":54,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":48,"cycle":49,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":42,"cycle":43,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":36,"cycle":37,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":30,"cycle":31,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":24,"cycle":25,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":16,"cycle":17,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":60,"cycle":61,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":752,"releaseId":67,"cycle":68,"description":753,"severity":162,"cvssScore":706,"epssScore":754,"inKev":21,"publishedAt":755,"url":756},{"cveId":767,"releaseId":53,"cycle":54,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},"CVE-2021-21395","Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.",4.2,0.00383,"2023-01-27T16:15:08.323+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21395",{"cveId":767,"releaseId":48,"cycle":49,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":42,"cycle":43,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":36,"cycle":37,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":30,"cycle":31,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":24,"cycle":25,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":16,"cycle":17,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":74,"cycle":75,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":67,"cycle":68,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":767,"releaseId":60,"cycle":61,"description":768,"severity":99,"cvssScore":769,"epssScore":770,"inKev":21,"publishedAt":771,"url":772},{"cveId":783,"releaseId":60,"cycle":61,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},"CVE-2021-28567","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.",6.5,0.00824,"2021-09-08T17:15:09.237+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28567",{"cveId":783,"releaseId":53,"cycle":54,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":48,"cycle":49,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":42,"cycle":43,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":36,"cycle":37,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":30,"cycle":31,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":24,"cycle":25,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":16,"cycle":17,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":74,"cycle":75,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":783,"releaseId":67,"cycle":68,"description":784,"severity":99,"cvssScore":785,"epssScore":786,"inKev":21,"publishedAt":787,"url":788},{"cveId":799,"releaseId":53,"cycle":54,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},"CVE-2021-28566","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.",3.7,0.01425,"2021-09-08T17:15:09.117+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28566",{"cveId":799,"releaseId":48,"cycle":49,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":42,"cycle":43,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":36,"cycle":37,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":30,"cycle":31,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":24,"cycle":25,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":16,"cycle":17,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":74,"cycle":75,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":67,"cycle":68,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":799,"releaseId":60,"cycle":61,"description":800,"severity":82,"cvssScore":801,"epssScore":802,"inKev":21,"publishedAt":803,"url":804},{"cveId":815,"releaseId":60,"cycle":61,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},"CVE-2021-32759","OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.",0.01336,"2021-08-27T22:15:07.193+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-32759",{"cveId":815,"releaseId":67,"cycle":68,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":74,"cycle":75,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":16,"cycle":17,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":24,"cycle":25,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":30,"cycle":31,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":36,"cycle":37,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":42,"cycle":43,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":48,"cycle":49,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":815,"releaseId":53,"cycle":54,"description":816,"severity":162,"cvssScore":706,"epssScore":817,"inKev":21,"publishedAt":818,"url":819},{"cveId":830,"releaseId":30,"cycle":31,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},"CVE-2021-32758","OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.",0.02009,"2021-08-27T18:15:07.173+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-32758",{"cveId":830,"releaseId":53,"cycle":54,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":48,"cycle":49,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":42,"cycle":43,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":36,"cycle":37,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":24,"cycle":25,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":16,"cycle":17,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":74,"cycle":75,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":67,"cycle":68,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":830,"releaseId":60,"cycle":61,"description":831,"severity":162,"cvssScore":706,"epssScore":832,"inKev":21,"publishedAt":833,"url":834},{"cveId":845,"releaseId":60,"cycle":61,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},"CVE-2021-28585","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.",0.01578,"2021-06-28T14:15:11.477+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28585",{"cveId":845,"releaseId":53,"cycle":54,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":48,"cycle":49,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":42,"cycle":43,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":36,"cycle":37,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":30,"cycle":31,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":24,"cycle":25,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":74,"cycle":75,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":16,"cycle":17,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":845,"releaseId":67,"cycle":68,"description":846,"severity":99,"cvssScore":146,"epssScore":847,"inKev":21,"publishedAt":848,"url":849},{"cveId":860,"releaseId":16,"cycle":17,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},"CVE-2021-28584","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.0178,"2021-06-28T14:15:11.277+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28584",{"cveId":860,"releaseId":30,"cycle":31,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":60,"cycle":61,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":53,"cycle":54,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":48,"cycle":49,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":42,"cycle":43,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":67,"cycle":68,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":36,"cycle":37,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":24,"cycle":25,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":860,"releaseId":74,"cycle":75,"description":861,"severity":99,"cvssScore":312,"epssScore":862,"inKev":21,"publishedAt":863,"url":864},{"cveId":875,"releaseId":30,"cycle":31,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},"CVE-2021-28583","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.",0.01897,"2021-06-28T14:15:11.073+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28583",{"cveId":875,"releaseId":53,"cycle":54,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":48,"cycle":49,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":42,"cycle":43,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":36,"cycle":37,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":24,"cycle":25,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":16,"cycle":17,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":74,"cycle":75,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":67,"cycle":68,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":875,"releaseId":60,"cycle":61,"description":876,"severity":162,"cvssScore":178,"epssScore":877,"inKev":21,"publishedAt":878,"url":879},{"cveId":890,"releaseId":30,"cycle":31,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},"CVE-2021-28563","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.",0.01429,"2021-06-28T14:15:10.22+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28563",{"cveId":890,"releaseId":24,"cycle":25,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":16,"cycle":17,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":74,"cycle":75,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":67,"cycle":68,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":60,"cycle":61,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":53,"cycle":54,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":48,"cycle":49,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":42,"cycle":43,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":890,"releaseId":36,"cycle":37,"description":891,"severity":99,"cvssScore":785,"epssScore":892,"inKev":21,"publishedAt":893,"url":894},{"cveId":905,"releaseId":60,"cycle":61,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},"CVE-2021-28556","Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.",6.9,0.01397,"2021-06-28T14:15:09.98+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-28556",{"cveId":905,"releaseId":24,"cycle":25,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":30,"cycle":31,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":16,"cycle":17,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":74,"cycle":75,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":67,"cycle":68,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":53,"cycle":54,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":48,"cycle":49,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":42,"cycle":43,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":905,"releaseId":36,"cycle":37,"description":906,"severity":99,"cvssScore":907,"epssScore":908,"inKev":21,"publishedAt":909,"url":910},{"cveId":921,"releaseId":16,"cycle":17,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},"CVE-2021-21427","Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.",0.01075,"2021-04-21T21:15:08.007+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21427",{"cveId":921,"releaseId":53,"cycle":54,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":48,"cycle":49,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":42,"cycle":43,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":36,"cycle":37,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":30,"cycle":31,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":24,"cycle":25,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":74,"cycle":75,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":67,"cycle":68,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":921,"releaseId":60,"cycle":61,"description":922,"severity":722,"cvssScore":723,"epssScore":923,"inKev":21,"publishedAt":924,"url":925},{"cveId":936,"releaseId":53,"cycle":54,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},"CVE-2021-21426","Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework.",9.8,0.01203,"2021-04-21T21:15:07.96+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21426",{"cveId":936,"releaseId":60,"cycle":61,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":67,"cycle":68,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":74,"cycle":75,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":16,"cycle":17,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":24,"cycle":25,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":30,"cycle":31,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":36,"cycle":37,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":42,"cycle":43,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":936,"releaseId":48,"cycle":49,"description":937,"severity":722,"cvssScore":938,"epssScore":939,"inKev":21,"publishedAt":940,"url":941},{"cveId":952,"releaseId":30,"cycle":31,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},"CVE-2021-21014","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.04213,"2021-02-11T21:15:12.54+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21014",{"cveId":952,"releaseId":24,"cycle":25,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":16,"cycle":17,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":74,"cycle":75,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":67,"cycle":68,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":60,"cycle":61,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":36,"cycle":37,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":42,"cycle":43,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":48,"cycle":49,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":952,"releaseId":53,"cycle":54,"description":953,"severity":722,"cvssScore":723,"epssScore":954,"inKev":21,"publishedAt":955,"url":956},{"cveId":967,"releaseId":30,"cycle":31,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},"CVE-2021-21032","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.",5.6,0.01558,"2021-02-11T20:15:14.95+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21032",{"cveId":967,"releaseId":53,"cycle":54,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":48,"cycle":49,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":42,"cycle":43,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":36,"cycle":37,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":24,"cycle":25,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":16,"cycle":17,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":74,"cycle":75,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":67,"cycle":68,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":967,"releaseId":60,"cycle":61,"description":968,"severity":99,"cvssScore":969,"epssScore":970,"inKev":21,"publishedAt":971,"url":972},{"cveId":983,"releaseId":60,"cycle":61,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},"CVE-2021-21031","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.",0.01673,"2021-02-11T20:15:14.887+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21031",{"cveId":983,"releaseId":16,"cycle":17,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":24,"cycle":25,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":30,"cycle":31,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":36,"cycle":37,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":48,"cycle":49,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":53,"cycle":54,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":42,"cycle":43,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":67,"cycle":68,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":983,"releaseId":74,"cycle":75,"description":984,"severity":99,"cvssScore":969,"epssScore":985,"inKev":21,"publishedAt":986,"url":987},{"cveId":998,"releaseId":74,"cycle":75,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},"CVE-2021-21030","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.",0.05616,"2021-02-11T20:15:14.827+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21030",{"cveId":998,"releaseId":67,"cycle":68,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":60,"cycle":61,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":30,"cycle":31,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":24,"cycle":25,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":36,"cycle":37,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":16,"cycle":17,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":42,"cycle":43,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":48,"cycle":49,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":998,"releaseId":53,"cycle":54,"description":999,"severity":162,"cvssScore":344,"epssScore":1000,"inKev":21,"publishedAt":1001,"url":1002},{"cveId":1013,"releaseId":67,"cycle":68,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},"CVE-2021-21029","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.",0.84641,"2021-02-11T20:15:14.763+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21029",{"cveId":1013,"releaseId":53,"cycle":54,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":48,"cycle":49,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":42,"cycle":43,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":36,"cycle":37,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":30,"cycle":31,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":24,"cycle":25,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":16,"cycle":17,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":74,"cycle":75,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1013,"releaseId":60,"cycle":61,"description":1014,"severity":99,"cvssScore":100,"epssScore":1015,"inKev":21,"publishedAt":1016,"url":1017},{"cveId":1028,"releaseId":36,"cycle":37,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},"CVE-2021-21027","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.",0.01661,"2021-02-11T20:15:14.623+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21027",{"cveId":1028,"releaseId":30,"cycle":31,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":24,"cycle":25,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":16,"cycle":17,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":74,"cycle":75,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":42,"cycle":43,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":48,"cycle":49,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":53,"cycle":54,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":67,"cycle":68,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1028,"releaseId":60,"cycle":61,"description":1029,"severity":99,"cvssScore":116,"epssScore":1030,"inKev":21,"publishedAt":1031,"url":1032},{"cveId":1043,"releaseId":42,"cycle":43,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},"CVE-2021-21026","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.",0.01808,"2021-02-11T20:15:14.56+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21026",{"cveId":1043,"releaseId":53,"cycle":54,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":48,"cycle":49,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":36,"cycle":37,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":30,"cycle":31,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":24,"cycle":25,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":16,"cycle":17,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":74,"cycle":75,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":67,"cycle":68,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1043,"releaseId":60,"cycle":61,"description":1044,"severity":99,"cvssScore":146,"epssScore":1045,"inKev":21,"publishedAt":1046,"url":1047},{"cveId":1058,"releaseId":53,"cycle":54,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},"CVE-2021-21025","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.03269,"2021-02-11T20:15:14.513+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21025",{"cveId":1058,"releaseId":48,"cycle":49,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":42,"cycle":43,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":36,"cycle":37,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":30,"cycle":31,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":24,"cycle":25,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":16,"cycle":17,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":74,"cycle":75,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":67,"cycle":68,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1058,"releaseId":60,"cycle":61,"description":1059,"severity":722,"cvssScore":723,"epssScore":1060,"inKev":21,"publishedAt":1061,"url":1062},{"cveId":1073,"releaseId":53,"cycle":54,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},"CVE-2021-21024","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.",0.02772,"2021-02-11T20:15:14.45+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21024",{"cveId":1073,"releaseId":48,"cycle":49,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":42,"cycle":43,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":36,"cycle":37,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":30,"cycle":31,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":24,"cycle":25,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":16,"cycle":17,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":74,"cycle":75,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":67,"cycle":68,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1073,"releaseId":60,"cycle":61,"description":1074,"severity":722,"cvssScore":723,"epssScore":1075,"inKev":21,"publishedAt":1076,"url":1077},{"cveId":1088,"releaseId":53,"cycle":54,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},"CVE-2021-21023","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.",0.01606,"2021-02-11T20:15:14.387+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21023",{"cveId":1088,"releaseId":48,"cycle":49,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":42,"cycle":43,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":36,"cycle":37,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":30,"cycle":31,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":24,"cycle":25,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":16,"cycle":17,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":74,"cycle":75,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":67,"cycle":68,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1088,"releaseId":60,"cycle":61,"description":1089,"severity":99,"cvssScore":100,"epssScore":1090,"inKev":21,"publishedAt":1091,"url":1092},{"cveId":1103,"releaseId":53,"cycle":54,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},"CVE-2021-21022","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.",0.02195,"2021-02-11T20:15:14.327+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21022",{"cveId":1103,"releaseId":48,"cycle":49,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":42,"cycle":43,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":36,"cycle":37,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":30,"cycle":31,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":24,"cycle":25,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":16,"cycle":17,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":74,"cycle":75,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":67,"cycle":68,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1103,"releaseId":60,"cycle":61,"description":1104,"severity":99,"cvssScore":146,"epssScore":1105,"inKev":21,"publishedAt":1106,"url":1107},{"cveId":1118,"releaseId":30,"cycle":31,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},"CVE-2021-21020","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.",0.02412,"2021-02-11T20:15:14.187+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21020",{"cveId":1118,"releaseId":24,"cycle":25,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":16,"cycle":17,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":53,"cycle":54,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":74,"cycle":75,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":42,"cycle":43,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":67,"cycle":68,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":60,"cycle":61,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":48,"cycle":49,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1118,"releaseId":36,"cycle":37,"description":1119,"severity":99,"cvssScore":146,"epssScore":1120,"inKev":21,"publishedAt":1121,"url":1122},{"cveId":1133,"releaseId":16,"cycle":17,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},"CVE-2021-21019","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.03635,"2021-02-11T20:15:14.123+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21019",{"cveId":1133,"releaseId":53,"cycle":54,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":48,"cycle":49,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":42,"cycle":43,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":36,"cycle":37,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":30,"cycle":31,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":24,"cycle":25,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":74,"cycle":75,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":67,"cycle":68,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1133,"releaseId":60,"cycle":61,"description":1134,"severity":722,"cvssScore":723,"epssScore":1135,"inKev":21,"publishedAt":1136,"url":1137},{"cveId":1148,"releaseId":53,"cycle":54,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},"CVE-2021-21018","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.0399,"2021-02-11T20:15:14.077+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21018",{"cveId":1148,"releaseId":48,"cycle":49,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":42,"cycle":43,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":36,"cycle":37,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":30,"cycle":31,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":24,"cycle":25,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":16,"cycle":17,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":74,"cycle":75,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":67,"cycle":68,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1148,"releaseId":60,"cycle":61,"description":1149,"severity":722,"cvssScore":723,"epssScore":1150,"inKev":21,"publishedAt":1151,"url":1152},{"cveId":1163,"releaseId":24,"cycle":25,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},"CVE-2021-21016","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.0485,"2021-02-11T20:15:13.92+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21016",{"cveId":1163,"releaseId":53,"cycle":54,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":48,"cycle":49,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":42,"cycle":43,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":36,"cycle":37,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":30,"cycle":31,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":16,"cycle":17,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":74,"cycle":75,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":67,"cycle":68,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1163,"releaseId":60,"cycle":61,"description":1164,"severity":722,"cvssScore":723,"epssScore":1165,"inKev":21,"publishedAt":1166,"url":1167},{"cveId":1178,"releaseId":48,"cycle":49,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},"CVE-2021-21015","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",0.0293,"2021-02-11T20:15:13.827+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21015",{"cveId":1178,"releaseId":42,"cycle":43,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":53,"cycle":54,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":36,"cycle":37,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":30,"cycle":31,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":24,"cycle":25,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":16,"cycle":17,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":74,"cycle":75,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":67,"cycle":68,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1178,"releaseId":60,"cycle":61,"description":1179,"severity":162,"cvssScore":407,"epssScore":1180,"inKev":21,"publishedAt":1181,"url":1182},{"cveId":1193,"releaseId":30,"cycle":31,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},"CVE-2020-26295","OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import\u002Fexport data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved",0.01782,"2021-01-21T14:15:12.817+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-26295",{"cveId":1193,"releaseId":53,"cycle":54,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":48,"cycle":49,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":42,"cycle":43,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":36,"cycle":37,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":24,"cycle":25,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":16,"cycle":17,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":74,"cycle":75,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":67,"cycle":68,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1193,"releaseId":60,"cycle":61,"description":1194,"severity":162,"cvssScore":163,"epssScore":1195,"inKev":21,"publishedAt":1196,"url":1197},{"cveId":1208,"releaseId":60,"cycle":61,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},"CVE-2020-26285","OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import\u002Fexport data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved",0.02878,"2021-01-21T14:15:12.62+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-26285",{"cveId":1208,"releaseId":53,"cycle":54,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":36,"cycle":37,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":30,"cycle":31,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":24,"cycle":25,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":42,"cycle":43,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":16,"cycle":17,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":74,"cycle":75,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":67,"cycle":68,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1208,"releaseId":48,"cycle":49,"description":1209,"severity":162,"cvssScore":163,"epssScore":1210,"inKev":21,"publishedAt":1211,"url":1212},{"cveId":1223,"releaseId":36,"cycle":37,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},"CVE-2020-26252","OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.",0.02057,"2021-01-20T22:15:11+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-26252",{"cveId":1223,"releaseId":60,"cycle":61,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":67,"cycle":68,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":74,"cycle":75,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":16,"cycle":17,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":24,"cycle":25,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":30,"cycle":31,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":42,"cycle":43,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":48,"cycle":49,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1223,"releaseId":53,"cycle":54,"description":1224,"severity":162,"cvssScore":163,"epssScore":1225,"inKev":21,"publishedAt":1226,"url":1227},{"cveId":1238,"releaseId":60,"cycle":61,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},"CVE-2021-21013","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.",0.03181,"2021-01-13T23:15:14.493+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21013",{"cveId":1238,"releaseId":74,"cycle":75,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":67,"cycle":68,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":24,"cycle":25,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":30,"cycle":31,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":36,"cycle":37,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":48,"cycle":49,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":53,"cycle":54,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":42,"cycle":43,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1238,"releaseId":16,"cycle":17,"description":1239,"severity":162,"cvssScore":344,"epssScore":1240,"inKev":21,"publishedAt":1241,"url":1242},{"cveId":1253,"releaseId":67,"cycle":68,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},"CVE-2021-21012","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.",0.03951,"2021-01-13T23:15:14.4+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-21012",{"cveId":1253,"releaseId":53,"cycle":54,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":48,"cycle":49,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":42,"cycle":43,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":36,"cycle":37,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":30,"cycle":31,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":24,"cycle":25,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":16,"cycle":17,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":74,"cycle":75,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1253,"releaseId":60,"cycle":61,"description":1254,"severity":99,"cvssScore":146,"epssScore":1255,"inKev":21,"publishedAt":1256,"url":1257},{"cveId":1268,"releaseId":67,"cycle":68,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},"CVE-2020-24407","Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System\u002FData and Transfer\u002FImport components.",0.05272,"2020-11-09T01:15:12.99+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24407",{"cveId":1268,"releaseId":53,"cycle":54,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":48,"cycle":49,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":42,"cycle":43,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":36,"cycle":37,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":30,"cycle":31,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":24,"cycle":25,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":16,"cycle":17,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":74,"cycle":75,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1268,"releaseId":60,"cycle":61,"description":1269,"severity":722,"cvssScore":723,"epssScore":1270,"inKev":21,"publishedAt":1271,"url":1272},{"cveId":1283,"releaseId":60,"cycle":61,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},"CVE-2020-24406","When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.",0.02078,"2020-11-09T01:15:12.88+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24406",{"cveId":1283,"releaseId":53,"cycle":54,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":48,"cycle":49,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":42,"cycle":43,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":36,"cycle":37,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":30,"cycle":31,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":24,"cycle":25,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":16,"cycle":17,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":74,"cycle":75,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1283,"releaseId":67,"cycle":68,"description":1284,"severity":82,"cvssScore":801,"epssScore":1285,"inKev":21,"publishedAt":1286,"url":1287},{"cveId":1298,"releaseId":60,"cycle":61,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},"CVE-2020-24405","Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.",0.01519,"2020-11-09T01:15:12.803+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24405",{"cveId":1298,"releaseId":53,"cycle":54,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":48,"cycle":49,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":42,"cycle":43,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":36,"cycle":37,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":30,"cycle":31,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":24,"cycle":25,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":16,"cycle":17,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":74,"cycle":75,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1298,"releaseId":67,"cycle":68,"description":1299,"severity":99,"cvssScore":116,"epssScore":1300,"inKev":21,"publishedAt":1301,"url":1302},{"cveId":1313,"releaseId":67,"cycle":68,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},"CVE-2020-24404","Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.",2.7,0.01579,"2020-11-09T01:15:12.707+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24404",{"cveId":1313,"releaseId":53,"cycle":54,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":48,"cycle":49,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":42,"cycle":43,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":36,"cycle":37,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":30,"cycle":31,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":24,"cycle":25,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":16,"cycle":17,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":74,"cycle":75,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1313,"releaseId":60,"cycle":61,"description":1314,"severity":82,"cvssScore":1315,"epssScore":1316,"inKev":21,"publishedAt":1317,"url":1318},{"cveId":1329,"releaseId":67,"cycle":68,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},"CVE-2020-24403","Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.",0.0163,"2020-11-09T01:15:12.62+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24403",{"cveId":1329,"releaseId":53,"cycle":54,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":48,"cycle":49,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":42,"cycle":43,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":36,"cycle":37,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":30,"cycle":31,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":24,"cycle":25,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":16,"cycle":17,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":74,"cycle":75,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1329,"releaseId":60,"cycle":61,"description":1330,"severity":82,"cvssScore":1315,"epssScore":1331,"inKev":21,"publishedAt":1332,"url":1333},{"cveId":1344,"releaseId":67,"cycle":68,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},"CVE-2020-24402","Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.",0.01703,"2020-11-09T01:15:12.49+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24402",{"cveId":1344,"releaseId":53,"cycle":54,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":48,"cycle":49,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":42,"cycle":43,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":36,"cycle":37,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":30,"cycle":31,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":24,"cycle":25,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":16,"cycle":17,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":74,"cycle":75,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1344,"releaseId":60,"cycle":61,"description":1345,"severity":99,"cvssScore":328,"epssScore":1346,"inKev":21,"publishedAt":1347,"url":1348},{"cveId":1359,"releaseId":60,"cycle":61,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},"CVE-2020-24401","Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.",0.0232,"2020-11-09T01:15:12.38+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24401",{"cveId":1359,"releaseId":53,"cycle":54,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":48,"cycle":49,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":42,"cycle":43,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":36,"cycle":37,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":30,"cycle":31,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":24,"cycle":25,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":16,"cycle":17,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":74,"cycle":75,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1359,"releaseId":67,"cycle":68,"description":1360,"severity":99,"cvssScore":785,"epssScore":1361,"inKev":21,"publishedAt":1362,"url":1363},{"cveId":1374,"releaseId":60,"cycle":61,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},"CVE-2020-24400","Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database.",7.1,0.02301,"2020-11-09T01:15:12.257+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24400",{"cveId":1374,"releaseId":53,"cycle":54,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":48,"cycle":49,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":42,"cycle":43,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":36,"cycle":37,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":30,"cycle":31,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":24,"cycle":25,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":16,"cycle":17,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":74,"cycle":75,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1374,"releaseId":67,"cycle":68,"description":1375,"severity":162,"cvssScore":1376,"epssScore":1377,"inKev":21,"publishedAt":1378,"url":1379},{"cveId":1390,"releaseId":67,"cycle":68,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},"CVE-2020-15244","In Magento (rubygems openmage\u002Fmagento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.",0.01264,"2020-10-21T20:15:13.443+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-15244",{"cveId":1390,"releaseId":53,"cycle":54,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":48,"cycle":49,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":42,"cycle":43,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":36,"cycle":37,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":30,"cycle":31,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":24,"cycle":25,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":16,"cycle":17,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":74,"cycle":75,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1390,"releaseId":60,"cycle":61,"description":1391,"severity":162,"cvssScore":407,"epssScore":1392,"inKev":21,"publishedAt":1393,"url":1394},{"cveId":1405,"releaseId":67,"cycle":68,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},"CVE-2020-24408","Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.",6.1,0.01741,"2020-10-16T15:15:11.203+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-24408",{"cveId":1405,"releaseId":53,"cycle":54,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":48,"cycle":49,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":42,"cycle":43,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":36,"cycle":37,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":30,"cycle":31,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":24,"cycle":25,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":16,"cycle":17,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":74,"cycle":75,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1405,"releaseId":60,"cycle":61,"description":1406,"severity":99,"cvssScore":1407,"epssScore":1408,"inKev":21,"publishedAt":1409,"url":1410},{"cveId":1421,"releaseId":67,"cycle":68,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},"CVE-2020-9692","Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.",0.03807,"2020-07-29T13:15:10.65+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9692",{"cveId":1421,"releaseId":53,"cycle":54,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":48,"cycle":49,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":42,"cycle":43,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":36,"cycle":37,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":30,"cycle":31,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":24,"cycle":25,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":16,"cycle":17,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":74,"cycle":75,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1421,"releaseId":60,"cycle":61,"description":1422,"severity":99,"cvssScore":785,"epssScore":1423,"inKev":21,"publishedAt":1424,"url":1425},{"cveId":1436,"releaseId":30,"cycle":31,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},"CVE-2020-9691","Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.",9.6,0.06018,"2020-07-29T13:15:10.587+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9691",{"cveId":1436,"releaseId":53,"cycle":54,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":48,"cycle":49,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":42,"cycle":43,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":36,"cycle":37,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":24,"cycle":25,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":16,"cycle":17,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":74,"cycle":75,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":67,"cycle":68,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1436,"releaseId":60,"cycle":61,"description":1437,"severity":722,"cvssScore":1438,"epssScore":1439,"inKev":21,"publishedAt":1440,"url":1441},{"cveId":1452,"releaseId":60,"cycle":61,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},"CVE-2020-9690","Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.",0.01632,"2020-07-29T13:15:10.54+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9690",{"cveId":1452,"releaseId":53,"cycle":54,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":48,"cycle":49,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":42,"cycle":43,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":36,"cycle":37,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":30,"cycle":31,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":24,"cycle":25,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":16,"cycle":17,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":74,"cycle":75,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1452,"releaseId":67,"cycle":68,"description":1453,"severity":99,"cvssScore":769,"epssScore":1454,"inKev":21,"publishedAt":1455,"url":1456},{"cveId":1467,"releaseId":30,"cycle":31,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},"CVE-2020-9689","Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.",0.04138,"2020-07-29T13:15:10.493+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9689",{"cveId":1467,"releaseId":53,"cycle":54,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":48,"cycle":49,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":42,"cycle":43,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":74,"cycle":75,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":67,"cycle":68,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":60,"cycle":61,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":16,"cycle":17,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":36,"cycle":37,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1467,"releaseId":24,"cycle":25,"description":1468,"severity":99,"cvssScore":785,"epssScore":1469,"inKev":21,"publishedAt":1470,"url":1471},{"cveId":1482,"releaseId":36,"cycle":37,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},"CVE-2020-9665","Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.","2020-07-22T20:15:12.157+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9665",{"cveId":1482,"releaseId":30,"cycle":31,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":24,"cycle":25,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":16,"cycle":17,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":74,"cycle":75,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":67,"cycle":68,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":60,"cycle":61,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":53,"cycle":54,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":48,"cycle":49,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1482,"releaseId":42,"cycle":43,"description":1483,"severity":99,"cvssScore":1407,"epssScore":892,"inKev":21,"publishedAt":1484,"url":1485},{"cveId":1496,"releaseId":36,"cycle":37,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},"CVE-2020-9664","Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.",0.08385,"2020-07-22T20:15:12.11+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9664",{"cveId":1496,"releaseId":30,"cycle":31,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":24,"cycle":25,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":16,"cycle":17,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":74,"cycle":75,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":67,"cycle":68,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":60,"cycle":61,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":53,"cycle":54,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":48,"cycle":49,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1496,"releaseId":42,"cycle":43,"description":1497,"severity":722,"cvssScore":938,"epssScore":1498,"inKev":21,"publishedAt":1499,"url":1500},{"cveId":1511,"releaseId":67,"cycle":68,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},"CVE-2020-9632","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.",0.07397,"2020-06-26T21:15:17.78+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9632",{"cveId":1511,"releaseId":53,"cycle":54,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":48,"cycle":49,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":42,"cycle":43,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":36,"cycle":37,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":30,"cycle":31,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":24,"cycle":25,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":16,"cycle":17,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":74,"cycle":75,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1511,"releaseId":60,"cycle":61,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1514,"url":1515},{"cveId":1526,"releaseId":53,"cycle":54,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},"CVE-2020-9631","2020-06-26T21:15:17.733+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9631",{"cveId":1526,"releaseId":48,"cycle":49,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":42,"cycle":43,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":74,"cycle":75,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":30,"cycle":31,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":16,"cycle":17,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":60,"cycle":61,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":67,"cycle":68,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":24,"cycle":25,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1526,"releaseId":36,"cycle":37,"description":1512,"severity":722,"cvssScore":938,"epssScore":1513,"inKev":21,"publishedAt":1527,"url":1528},{"cveId":1539,"releaseId":42,"cycle":43,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},"CVE-2020-9630","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.",0.03952,"2020-06-26T21:15:17.653+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9630",{"cveId":1539,"releaseId":36,"cycle":37,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":30,"cycle":31,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":24,"cycle":25,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":16,"cycle":17,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":74,"cycle":75,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":67,"cycle":68,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":60,"cycle":61,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":53,"cycle":54,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1539,"releaseId":48,"cycle":49,"description":1540,"severity":722,"cvssScore":938,"epssScore":1541,"inKev":21,"publishedAt":1542,"url":1543},{"cveId":1554,"releaseId":30,"cycle":31,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},"CVE-2020-9591","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel.",0.03425,"2020-06-26T21:15:17.403+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9591",{"cveId":1554,"releaseId":24,"cycle":25,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":16,"cycle":17,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":74,"cycle":75,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":67,"cycle":68,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":60,"cycle":61,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":48,"cycle":49,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":53,"cycle":54,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":42,"cycle":43,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1554,"releaseId":36,"cycle":37,"description":1555,"severity":162,"cvssScore":178,"epssScore":1556,"inKev":21,"publishedAt":1557,"url":1558},{"cveId":1569,"releaseId":30,"cycle":31,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},"CVE-2020-9588","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.",0.02924,"2020-06-26T21:15:17.327+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9588",{"cveId":1569,"releaseId":24,"cycle":25,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":16,"cycle":17,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":74,"cycle":75,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":67,"cycle":68,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":60,"cycle":61,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":53,"cycle":54,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":48,"cycle":49,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":42,"cycle":43,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1569,"releaseId":36,"cycle":37,"description":1570,"severity":162,"cvssScore":706,"epssScore":1571,"inKev":21,"publishedAt":1572,"url":1573},{"cveId":1584,"releaseId":60,"cycle":61,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},"CVE-2020-9587","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.",0.05009,"2020-06-26T21:15:17.263+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9587",{"cveId":1584,"releaseId":53,"cycle":54,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":48,"cycle":49,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":42,"cycle":43,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":36,"cycle":37,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":30,"cycle":31,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":24,"cycle":25,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":16,"cycle":17,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":74,"cycle":75,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1584,"releaseId":67,"cycle":68,"description":1585,"severity":162,"cvssScore":178,"epssScore":1586,"inKev":21,"publishedAt":1587,"url":1588},{"cveId":1599,"releaseId":30,"cycle":31,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},"CVE-2020-9585","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to arbitrary code execution.",0.04946,"2020-06-26T21:15:17.2+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9585",{"cveId":1599,"releaseId":24,"cycle":25,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":16,"cycle":17,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":36,"cycle":37,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":74,"cycle":75,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":67,"cycle":68,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":60,"cycle":61,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":42,"cycle":43,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":48,"cycle":49,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1599,"releaseId":53,"cycle":54,"description":1600,"severity":722,"cvssScore":938,"epssScore":1601,"inKev":21,"publishedAt":1602,"url":1603},{"cveId":1614,"releaseId":36,"cycle":37,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},"CVE-2020-9584","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.",0.01172,"2020-06-26T21:15:17.123+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9584",{"cveId":1614,"releaseId":30,"cycle":31,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":24,"cycle":25,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":16,"cycle":17,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":74,"cycle":75,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":67,"cycle":68,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":60,"cycle":61,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":53,"cycle":54,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":48,"cycle":49,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1614,"releaseId":42,"cycle":43,"description":1615,"severity":99,"cvssScore":312,"epssScore":1616,"inKev":21,"publishedAt":1617,"url":1618},{"cveId":1629,"releaseId":36,"cycle":37,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},"CVE-2020-9583","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.",0.0572,"2020-06-26T21:15:17.06+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9583",{"cveId":1629,"releaseId":30,"cycle":31,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":24,"cycle":25,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":16,"cycle":17,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":74,"cycle":75,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":67,"cycle":68,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":60,"cycle":61,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":53,"cycle":54,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":48,"cycle":49,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1629,"releaseId":42,"cycle":43,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1632,"url":1633},{"cveId":1644,"releaseId":36,"cycle":37,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},"CVE-2020-9582","2020-06-26T21:15:16.997+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9582",{"cveId":1644,"releaseId":30,"cycle":31,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":24,"cycle":25,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":16,"cycle":17,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":74,"cycle":75,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":67,"cycle":68,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":60,"cycle":61,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":53,"cycle":54,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":48,"cycle":49,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1644,"releaseId":42,"cycle":43,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1645,"url":1646},{"cveId":1657,"releaseId":42,"cycle":43,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},"CVE-2020-9581",0.01502,"2020-06-26T21:15:16.937+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9581",{"cveId":1657,"releaseId":53,"cycle":54,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":48,"cycle":49,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":36,"cycle":37,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":30,"cycle":31,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":24,"cycle":25,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":16,"cycle":17,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":74,"cycle":75,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":67,"cycle":68,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1657,"releaseId":60,"cycle":61,"description":1615,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1659,"url":1660},{"cveId":1671,"releaseId":24,"cycle":25,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},"CVE-2020-9580",0.05038,"2020-06-26T21:15:16.873+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9580",{"cveId":1671,"releaseId":16,"cycle":17,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":74,"cycle":75,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":67,"cycle":68,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":60,"cycle":61,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":53,"cycle":54,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":48,"cycle":49,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":42,"cycle":43,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":30,"cycle":31,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1671,"releaseId":36,"cycle":37,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1673,"url":1674},{"cveId":1685,"releaseId":74,"cycle":75,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},"CVE-2020-9579","2020-06-26T21:15:16.81+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9579",{"cveId":1685,"releaseId":67,"cycle":68,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":42,"cycle":43,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":60,"cycle":61,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":30,"cycle":31,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":36,"cycle":37,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":24,"cycle":25,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":16,"cycle":17,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":48,"cycle":49,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1685,"releaseId":53,"cycle":54,"description":1512,"severity":722,"cvssScore":938,"epssScore":1672,"inKev":21,"publishedAt":1686,"url":1687},{"cveId":1698,"releaseId":74,"cycle":75,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},"CVE-2020-9578","2020-06-26T21:15:16.747+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9578",{"cveId":1698,"releaseId":53,"cycle":54,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":48,"cycle":49,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":42,"cycle":43,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":36,"cycle":37,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":30,"cycle":31,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":24,"cycle":25,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":16,"cycle":17,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":67,"cycle":68,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1698,"releaseId":60,"cycle":61,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1699,"url":1700},{"cveId":1711,"releaseId":42,"cycle":43,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},"CVE-2020-9577","Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .","2020-06-26T21:15:16.67+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9577",{"cveId":1711,"releaseId":36,"cycle":37,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":30,"cycle":31,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":24,"cycle":25,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":16,"cycle":17,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":48,"cycle":49,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":53,"cycle":54,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":60,"cycle":61,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":74,"cycle":75,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1711,"releaseId":67,"cycle":68,"description":1712,"severity":99,"cvssScore":1407,"epssScore":1658,"inKev":21,"publishedAt":1713,"url":1714},{"cveId":1725,"releaseId":48,"cycle":49,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},"CVE-2020-9576","2020-06-26T21:15:16.607+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-9576",{"cveId":1725,"releaseId":53,"cycle":54,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":42,"cycle":43,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":36,"cycle":37,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":30,"cycle":31,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":24,"cycle":25,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":16,"cycle":17,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":74,"cycle":75,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":67,"cycle":68,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1725,"releaseId":60,"cycle":61,"description":1630,"severity":722,"cvssScore":938,"epssScore":1631,"inKev":21,"publishedAt":1726,"url":1727},{"cveId":1738,"releaseId":42,"cycle":43,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},"CVE-2012-6091","Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.",0.01993,"2020-02-13T20:15:09.877+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2012-6091",{"cveId":1738,"releaseId":36,"cycle":37,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":30,"cycle":31,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":74,"cycle":75,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":67,"cycle":68,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":60,"cycle":61,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":48,"cycle":49,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1738,"releaseId":53,"cycle":54,"description":1739,"severity":162,"cvssScore":178,"epssScore":1740,"inKev":21,"publishedAt":1741,"url":1742},{"cveId":1751,"releaseId":42,"cycle":43,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},"CVE-2020-3758","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.",0.01838,"2020-01-29T19:15:14.087+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3758",{"cveId":1751,"releaseId":36,"cycle":37,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":30,"cycle":31,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":24,"cycle":25,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":16,"cycle":17,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":74,"cycle":75,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":67,"cycle":68,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":60,"cycle":61,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":53,"cycle":54,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1751,"releaseId":48,"cycle":49,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1754,"url":1755},{"cveId":1766,"releaseId":42,"cycle":43,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},"CVE-2020-3719","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.",0.03161,"2020-01-29T19:15:14.027+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3719",{"cveId":1766,"releaseId":36,"cycle":37,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":30,"cycle":31,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":24,"cycle":25,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":16,"cycle":17,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":74,"cycle":75,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":67,"cycle":68,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":60,"cycle":61,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":53,"cycle":54,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1766,"releaseId":48,"cycle":49,"description":1767,"severity":162,"cvssScore":178,"epssScore":1768,"inKev":21,"publishedAt":1769,"url":1770},{"cveId":1781,"releaseId":42,"cycle":43,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},"CVE-2020-3718","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.",0.07516,"2020-01-29T19:15:13.947+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3718",{"cveId":1781,"releaseId":53,"cycle":54,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":48,"cycle":49,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":36,"cycle":37,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":30,"cycle":31,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":24,"cycle":25,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":16,"cycle":17,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":74,"cycle":75,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":67,"cycle":68,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1781,"releaseId":60,"cycle":61,"description":1782,"severity":722,"cvssScore":938,"epssScore":1783,"inKev":21,"publishedAt":1784,"url":1785},{"cveId":1796,"releaseId":74,"cycle":75,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},"CVE-2020-3717","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.","2020-01-29T19:15:13.887+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3717",{"cveId":1796,"releaseId":67,"cycle":68,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":30,"cycle":31,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":24,"cycle":25,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":48,"cycle":49,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":60,"cycle":61,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":42,"cycle":43,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":53,"cycle":54,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":36,"cycle":37,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1796,"releaseId":16,"cycle":17,"description":1797,"severity":99,"cvssScore":146,"epssScore":1768,"inKev":21,"publishedAt":1798,"url":1799},{"cveId":1810,"releaseId":24,"cycle":25,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},"CVE-2020-3716","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.",0.13964,"2020-01-29T19:15:13.823+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3716",{"cveId":1810,"releaseId":16,"cycle":17,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":74,"cycle":75,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":67,"cycle":68,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":60,"cycle":61,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":42,"cycle":43,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":36,"cycle":37,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":30,"cycle":31,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":48,"cycle":49,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1810,"releaseId":53,"cycle":54,"description":1811,"severity":722,"cvssScore":938,"epssScore":1812,"inKev":21,"publishedAt":1813,"url":1814},{"cveId":1825,"releaseId":74,"cycle":75,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},"CVE-2020-3715","2020-01-29T19:15:13.743+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2020-3715",{"cveId":1825,"releaseId":53,"cycle":54,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":48,"cycle":49,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":42,"cycle":43,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":36,"cycle":37,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":30,"cycle":31,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":24,"cycle":25,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":16,"cycle":17,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":67,"cycle":68,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1825,"releaseId":60,"cycle":61,"description":1752,"severity":99,"cvssScore":1407,"epssScore":1753,"inKev":21,"publishedAt":1826,"url":1827},{"cveId":1838,"releaseId":42,"cycle":43,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},"CVE-2015-6497","The create function in app\u002Fcode\u002Fcore\u002FMage\u002FCatalog\u002FModel\u002FProduct\u002FApi\u002FV2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php\u002Fapi\u002Fv2_soap.",0.0737,"2020-01-15T17:15:13.597+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-6497",{"cveId":1838,"releaseId":36,"cycle":37,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":30,"cycle":31,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":24,"cycle":25,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":16,"cycle":17,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":74,"cycle":75,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":48,"cycle":49,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":53,"cycle":54,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":67,"cycle":68,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1838,"releaseId":60,"cycle":61,"description":1839,"severity":162,"cvssScore":296,"epssScore":1840,"inKev":21,"publishedAt":1841,"url":1842},{"cveId":1853,"releaseId":16,"cycle":17,"description":1854,"severity":99,"cvssScore":1855,"epssScore":1856,"inKev":21,"publishedAt":1857,"url":1858},"CVE-2019-8232","In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.",6.6,0.00851,"2019-11-06T00:15:13.203+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8232",{"cveId":1853,"releaseId":42,"cycle":43,"description":1854,"severity":99,"cvssScore":1855,"epssScore":1856,"inKev":21,"publishedAt":1857,"url":1858},{"cveId":1853,"releaseId":36,"cycle":37,"description":1854,"severity":99,"cvssScore":1855,"epssScore":1856,"inKev":21,"publishedAt":1857,"url":1858},{"cveId":1853,"releaseId":30,"cycle":31,"description":1854,"severity":99,"cvssScore":1855,"epssScore":1856,"inKev":21,"publishedAt":1857,"url":1858},{"cveId":1853,"releaseId":24,"cycle":25,"description":1854,"severity":99,"cvssScore":1855,"epssScore":1856,"inKev":21,"publishedAt":1857,"url":1858},{"cveId":1864,"releaseId":30,"cycle":31,"description":1865,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1867,"url":1868},"CVE-2019-8231","In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.",0.01412,"2019-11-06T00:15:13.14+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8231",{"cveId":1864,"releaseId":24,"cycle":25,"description":1865,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1867,"url":1868},{"cveId":1864,"releaseId":16,"cycle":17,"description":1865,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1867,"url":1868},{"cveId":1864,"releaseId":36,"cycle":37,"description":1865,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1867,"url":1868},{"cveId":1864,"releaseId":42,"cycle":43,"description":1865,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1867,"url":1868},{"cveId":1874,"releaseId":30,"cycle":31,"description":1875,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1876,"url":1877},"CVE-2019-8230","In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support\u002Foutput path.","2019-11-06T00:15:13.077+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8230",{"cveId":1874,"releaseId":24,"cycle":25,"description":1875,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1876,"url":1877},{"cveId":1874,"releaseId":16,"cycle":17,"description":1875,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1876,"url":1877},{"cveId":1874,"releaseId":42,"cycle":43,"description":1875,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1876,"url":1877},{"cveId":1874,"releaseId":36,"cycle":37,"description":1875,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1876,"url":1877},{"cveId":1883,"releaseId":30,"cycle":31,"description":1884,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1885,"url":1886},"CVE-2019-8229","In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates.","2019-11-06T00:15:13.013+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8229",{"cveId":1883,"releaseId":24,"cycle":25,"description":1884,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1885,"url":1886},{"cveId":1883,"releaseId":16,"cycle":17,"description":1884,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1885,"url":1886},{"cveId":1883,"releaseId":42,"cycle":43,"description":1884,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1885,"url":1886},{"cveId":1883,"releaseId":36,"cycle":37,"description":1884,"severity":162,"cvssScore":706,"epssScore":1866,"inKev":21,"publishedAt":1885,"url":1886},{"cveId":1892,"releaseId":30,"cycle":31,"description":1893,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1895,"url":1896},"CVE-2019-8228","in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template.",0.00517,"2019-11-06T00:15:12.953+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8228",{"cveId":1892,"releaseId":24,"cycle":25,"description":1893,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1895,"url":1896},{"cveId":1892,"releaseId":16,"cycle":17,"description":1893,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1895,"url":1896},{"cveId":1892,"releaseId":42,"cycle":43,"description":1893,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1895,"url":1896},{"cveId":1892,"releaseId":36,"cycle":37,"description":1893,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1895,"url":1896},{"cveId":1902,"releaseId":30,"cycle":31,"description":1903,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1904,"url":1905},"CVE-2019-8227","In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import \u002F export functionality when creating profile action XML.","2019-11-06T00:15:12.873+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8227",{"cveId":1902,"releaseId":24,"cycle":25,"description":1903,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1904,"url":1905},{"cveId":1902,"releaseId":16,"cycle":17,"description":1903,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1904,"url":1905},{"cveId":1902,"releaseId":42,"cycle":43,"description":1903,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1904,"url":1905},{"cveId":1902,"releaseId":36,"cycle":37,"description":1903,"severity":99,"cvssScore":100,"epssScore":1894,"inKev":21,"publishedAt":1904,"url":1905},{"cveId":1911,"releaseId":30,"cycle":31,"description":1912,"severity":162,"cvssScore":178,"epssScore":1913,"inKev":21,"publishedAt":1914,"url":1915},"CVE-2019-8155","Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.",0.00499,"2019-11-06T00:15:12.763+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8155",{"cveId":1911,"releaseId":24,"cycle":25,"description":1912,"severity":162,"cvssScore":178,"epssScore":1913,"inKev":21,"publishedAt":1914,"url":1915},{"cveId":1911,"releaseId":16,"cycle":17,"description":1912,"severity":162,"cvssScore":178,"epssScore":1913,"inKev":21,"publishedAt":1914,"url":1915},{"cveId":1911,"releaseId":42,"cycle":43,"description":1912,"severity":162,"cvssScore":178,"epssScore":1913,"inKev":21,"publishedAt":1914,"url":1915},{"cveId":1911,"releaseId":36,"cycle":37,"description":1912,"severity":162,"cvssScore":178,"epssScore":1913,"inKev":21,"publishedAt":1914,"url":1915},{"cveId":1921,"releaseId":30,"cycle":31,"description":1922,"severity":99,"cvssScore":312,"epssScore":1923,"inKev":21,"publishedAt":1924,"url":1925},"CVE-2019-8152","A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.",0.00591,"2019-11-06T00:15:12.577+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8152",{"cveId":1921,"releaseId":24,"cycle":25,"description":1922,"severity":99,"cvssScore":312,"epssScore":1923,"inKev":21,"publishedAt":1924,"url":1925},{"cveId":1921,"releaseId":16,"cycle":17,"description":1922,"severity":99,"cvssScore":312,"epssScore":1923,"inKev":21,"publishedAt":1924,"url":1925},{"cveId":1921,"releaseId":42,"cycle":43,"description":1922,"severity":99,"cvssScore":312,"epssScore":1923,"inKev":21,"publishedAt":1924,"url":1925},{"cveId":1921,"releaseId":36,"cycle":37,"description":1922,"severity":99,"cvssScore":312,"epssScore":1923,"inKev":21,"publishedAt":1924,"url":1925},{"cveId":1931,"releaseId":36,"cycle":37,"description":1932,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1934,"url":1935},"CVE-2019-8125","A remote code execution vulnerability exists in Magento 1 prior to 1.9.x and 1.14.x. An authenticated admin user can modify configuration parameters via crafted support configuration. The modification can lead to remote code execution.",0.01745,"2019-11-05T23:15:12.697+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8125",{"cveId":1931,"releaseId":30,"cycle":31,"description":1932,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1934,"url":1935},{"cveId":1931,"releaseId":24,"cycle":25,"description":1932,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1934,"url":1935},{"cveId":1931,"releaseId":16,"cycle":17,"description":1932,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1934,"url":1935},{"cveId":1931,"releaseId":42,"cycle":43,"description":1932,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1934,"url":1935},{"cveId":1941,"releaseId":48,"cycle":49,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},"CVE-2019-8123","An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track configuration changes.",0.00811,"2019-11-05T23:15:12.57+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8123",{"cveId":1941,"releaseId":53,"cycle":54,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":42,"cycle":43,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":36,"cycle":37,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":30,"cycle":31,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":24,"cycle":25,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":16,"cycle":17,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":74,"cycle":75,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":67,"cycle":68,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1941,"releaseId":60,"cycle":61,"description":1942,"severity":99,"cvssScore":146,"epssScore":1943,"inKev":21,"publishedAt":1944,"url":1945},{"cveId":1956,"releaseId":36,"cycle":37,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},"CVE-2019-8114","A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.",0.01852,"2019-11-05T23:15:12.023+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8114",{"cveId":1956,"releaseId":30,"cycle":31,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":48,"cycle":49,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":24,"cycle":25,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":16,"cycle":17,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":74,"cycle":75,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":67,"cycle":68,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":60,"cycle":61,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":53,"cycle":54,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1956,"releaseId":42,"cycle":43,"description":1957,"severity":162,"cvssScore":706,"epssScore":1958,"inKev":21,"publishedAt":1959,"url":1960},{"cveId":1971,"releaseId":24,"cycle":25,"description":1972,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1973,"url":1974},"CVE-2019-8091","A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution.","2019-11-05T23:15:11.43+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-8091",{"cveId":1971,"releaseId":16,"cycle":17,"description":1972,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1973,"url":1974},{"cveId":1971,"releaseId":36,"cycle":37,"description":1972,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1973,"url":1974},{"cveId":1971,"releaseId":42,"cycle":43,"description":1972,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1973,"url":1974},{"cveId":1971,"releaseId":30,"cycle":31,"description":1972,"severity":162,"cvssScore":706,"epssScore":1933,"inKev":21,"publishedAt":1973,"url":1974},{"cveId":1980,"releaseId":30,"cycle":31,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},"CVE-2019-7947","A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.",0.00439,"2019-08-02T22:15:19.347+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7947",{"cveId":1980,"releaseId":24,"cycle":25,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":16,"cycle":17,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":67,"cycle":68,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":60,"cycle":61,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":74,"cycle":75,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":53,"cycle":54,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":48,"cycle":49,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":42,"cycle":43,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1980,"releaseId":36,"cycle":37,"description":1981,"severity":99,"cvssScore":785,"epssScore":1982,"inKev":21,"publishedAt":1983,"url":1984},{"cveId":1995,"releaseId":53,"cycle":54,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},"CVE-2019-7945","A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.",0.00566,"2019-08-02T22:15:19.283+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7945",{"cveId":1995,"releaseId":42,"cycle":43,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":36,"cycle":37,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":30,"cycle":31,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":24,"cycle":25,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":16,"cycle":17,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":74,"cycle":75,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":67,"cycle":68,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":60,"cycle":61,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":1995,"releaseId":48,"cycle":49,"description":1996,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":1998,"url":1999},{"cveId":2010,"releaseId":36,"cycle":37,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},"CVE-2019-7944","A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.","2019-08-02T22:15:19.207+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7944",{"cveId":2010,"releaseId":53,"cycle":54,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":48,"cycle":49,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":42,"cycle":43,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":30,"cycle":31,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":24,"cycle":25,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":16,"cycle":17,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":74,"cycle":75,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":67,"cycle":68,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2010,"releaseId":60,"cycle":61,"description":2011,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2012,"url":2013},{"cveId":2024,"releaseId":48,"cycle":49,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},"CVE-2019-7940","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript.",0.00557,"2019-08-02T22:15:19.08+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7940",{"cveId":2024,"releaseId":42,"cycle":43,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":36,"cycle":37,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":30,"cycle":31,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":24,"cycle":25,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":16,"cycle":17,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":74,"cycle":75,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":67,"cycle":68,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":60,"cycle":61,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2024,"releaseId":53,"cycle":54,"description":2025,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2027,"url":2028},{"cveId":2039,"releaseId":48,"cycle":49,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},"CVE-2019-7938","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.","2019-08-02T22:15:18.923+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7938",{"cveId":2039,"releaseId":42,"cycle":43,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":36,"cycle":37,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":30,"cycle":31,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":24,"cycle":25,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":16,"cycle":17,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":74,"cycle":75,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":67,"cycle":68,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":60,"cycle":61,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2039,"releaseId":53,"cycle":54,"description":2040,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2041,"url":2042},{"cveId":2053,"releaseId":48,"cycle":49,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},"CVE-2019-7935","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.","2019-08-02T22:15:18.737+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7935",{"cveId":2053,"releaseId":42,"cycle":43,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":36,"cycle":37,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":30,"cycle":31,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":24,"cycle":25,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":16,"cycle":17,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":74,"cycle":75,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":67,"cycle":68,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":60,"cycle":61,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2053,"releaseId":53,"cycle":54,"description":2054,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2055,"url":2056},{"cveId":2067,"releaseId":60,"cycle":61,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},"CVE-2019-7934","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.","2019-08-02T22:15:18.673+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7934",{"cveId":2067,"releaseId":53,"cycle":54,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":48,"cycle":49,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":42,"cycle":43,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":36,"cycle":37,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":30,"cycle":31,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":24,"cycle":25,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":16,"cycle":17,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":74,"cycle":75,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2067,"releaseId":67,"cycle":68,"description":2068,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2069,"url":2070},{"cveId":2081,"releaseId":53,"cycle":54,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},"CVE-2019-7932","A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.",0.02413,"2019-08-02T22:15:18.613+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7932",{"cveId":2081,"releaseId":48,"cycle":49,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":42,"cycle":43,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":36,"cycle":37,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":30,"cycle":31,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":24,"cycle":25,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":16,"cycle":17,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":74,"cycle":75,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":67,"cycle":68,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2081,"releaseId":60,"cycle":61,"description":2082,"severity":162,"cvssScore":706,"epssScore":2083,"inKev":21,"publishedAt":2084,"url":2085},{"cveId":2096,"releaseId":53,"cycle":54,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},"CVE-2019-7909","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.","2019-08-02T22:15:17.707+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7909",{"cveId":2096,"releaseId":48,"cycle":49,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":42,"cycle":43,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":36,"cycle":37,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":30,"cycle":31,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":24,"cycle":25,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":16,"cycle":17,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":74,"cycle":75,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":67,"cycle":68,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2096,"releaseId":60,"cycle":61,"description":2097,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2098,"url":2099},{"cveId":2110,"releaseId":53,"cycle":54,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},"CVE-2019-7899","Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.",0.00928,"2019-08-02T22:15:17.393+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7899",{"cveId":2110,"releaseId":48,"cycle":49,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":42,"cycle":43,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":36,"cycle":37,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":30,"cycle":31,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":24,"cycle":25,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":16,"cycle":17,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":74,"cycle":75,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":67,"cycle":68,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2110,"releaseId":60,"cycle":61,"description":2111,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2113,"url":2114},{"cveId":2125,"releaseId":53,"cycle":54,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},"CVE-2019-7898","Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.","2019-08-02T22:15:17.317+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7898",{"cveId":2125,"releaseId":48,"cycle":49,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":42,"cycle":43,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":36,"cycle":37,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":30,"cycle":31,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":24,"cycle":25,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":16,"cycle":17,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":74,"cycle":75,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":67,"cycle":68,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2125,"releaseId":60,"cycle":61,"description":2126,"severity":99,"cvssScore":146,"epssScore":2112,"inKev":21,"publishedAt":2127,"url":2128},{"cveId":2139,"releaseId":53,"cycle":54,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},"CVE-2019-7897","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript.","2019-08-02T22:15:17.253+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7897",{"cveId":2139,"releaseId":48,"cycle":49,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":42,"cycle":43,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":36,"cycle":37,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":30,"cycle":31,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":24,"cycle":25,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":16,"cycle":17,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":74,"cycle":75,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":67,"cycle":68,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2139,"releaseId":60,"cycle":61,"description":2140,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2141,"url":2142},{"cveId":2153,"releaseId":42,"cycle":43,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},"CVE-2019-7889","An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.",0.00805,"2019-08-02T22:15:16.863+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7889",{"cveId":2153,"releaseId":36,"cycle":37,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":30,"cycle":31,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":24,"cycle":25,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":16,"cycle":17,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":48,"cycle":49,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":74,"cycle":75,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":67,"cycle":68,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":60,"cycle":61,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2153,"releaseId":53,"cycle":54,"description":2154,"severity":99,"cvssScore":785,"epssScore":2155,"inKev":21,"publishedAt":2156,"url":2157},{"cveId":2168,"releaseId":67,"cycle":68,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},"CVE-2019-7887","A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.","2019-08-02T22:15:16.707+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7887",{"cveId":2168,"releaseId":53,"cycle":54,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":48,"cycle":49,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":42,"cycle":43,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":36,"cycle":37,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":30,"cycle":31,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":24,"cycle":25,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":16,"cycle":17,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":74,"cycle":75,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2168,"releaseId":60,"cycle":61,"description":2169,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2170,"url":2171},{"cveId":2182,"releaseId":67,"cycle":68,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},"CVE-2019-7882","A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.","2019-08-02T22:15:16.503+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7882",{"cveId":2182,"releaseId":60,"cycle":61,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":53,"cycle":54,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":48,"cycle":49,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":42,"cycle":43,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":36,"cycle":37,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":30,"cycle":31,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":24,"cycle":25,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":16,"cycle":17,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2182,"releaseId":74,"cycle":75,"description":2183,"severity":99,"cvssScore":312,"epssScore":1997,"inKev":21,"publishedAt":2184,"url":2185},{"cveId":2196,"releaseId":67,"cycle":68,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},"CVE-2019-7875","A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.","2019-08-02T22:15:16.16+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7875",{"cveId":2196,"releaseId":53,"cycle":54,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":48,"cycle":49,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":42,"cycle":43,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":36,"cycle":37,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":30,"cycle":31,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":24,"cycle":25,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":16,"cycle":17,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":74,"cycle":75,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2196,"releaseId":60,"cycle":61,"description":2197,"severity":99,"cvssScore":100,"epssScore":2026,"inKev":21,"publishedAt":2198,"url":2199},{"cveId":2210,"releaseId":60,"cycle":61,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},"CVE-2019-7849","A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2.",0.01151,"2019-08-02T22:15:14.643+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7849",{"cveId":2210,"releaseId":53,"cycle":54,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":48,"cycle":49,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":42,"cycle":43,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":36,"cycle":37,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":30,"cycle":31,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":24,"cycle":25,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":16,"cycle":17,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":74,"cycle":75,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2210,"releaseId":67,"cycle":68,"description":2211,"severity":162,"cvssScore":178,"epssScore":2212,"inKev":21,"publishedAt":2213,"url":2214},{"cveId":2225,"releaseId":67,"cycle":68,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},"CVE-2019-7139","An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.",0.17657,"2019-04-10T18:29:01.247+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2019-7139",{"cveId":2225,"releaseId":53,"cycle":54,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":48,"cycle":49,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":42,"cycle":43,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":36,"cycle":37,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":30,"cycle":31,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":24,"cycle":25,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":16,"cycle":17,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":74,"cycle":75,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2225,"releaseId":60,"cycle":61,"description":2226,"severity":722,"cvssScore":938,"epssScore":2227,"inKev":21,"publishedAt":2228,"url":2229},{"cveId":2240,"releaseId":67,"cycle":68,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},"CVE-2018-5301","Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.",0.0043,"2018-01-08T22:29:00.213+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2018-5301",{"cveId":2240,"releaseId":53,"cycle":54,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":48,"cycle":49,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":42,"cycle":43,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":36,"cycle":37,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":30,"cycle":31,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":24,"cycle":25,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":16,"cycle":17,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":74,"cycle":75,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2240,"releaseId":60,"cycle":61,"description":2241,"severity":99,"cvssScore":785,"epssScore":2242,"inKev":21,"publishedAt":2243,"url":2244},{"cveId":2255,"releaseId":67,"cycle":68,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},"CVE-2016-10704","Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.",0.00637,"2017-12-30T21:29:00.24+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2016-10704",{"cveId":2255,"releaseId":53,"cycle":54,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":48,"cycle":49,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":42,"cycle":43,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":36,"cycle":37,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":30,"cycle":31,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":24,"cycle":25,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":16,"cycle":17,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":74,"cycle":75,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2255,"releaseId":60,"cycle":61,"description":2256,"severity":99,"cvssScore":1407,"epssScore":2257,"inKev":21,"publishedAt":2258,"url":2259},{"cveId":2270,"releaseId":36,"cycle":37,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},"CVE-2015-8707","Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.",0.0132,"2017-09-26T01:29:00.523+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-8707",{"cveId":2270,"releaseId":53,"cycle":54,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":48,"cycle":49,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":42,"cycle":43,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":30,"cycle":31,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":24,"cycle":25,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":16,"cycle":17,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":74,"cycle":75,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":67,"cycle":68,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2270,"releaseId":60,"cycle":61,"description":2271,"severity":722,"cvssScore":938,"epssScore":2272,"inKev":21,"publishedAt":2273,"url":2274},{"cveId":2285,"releaseId":16,"cycle":17,"description":2286,"severity":99,"cvssScore":1407,"epssScore":2287,"inKev":21,"publishedAt":2288,"url":2289},"CVE-2014-9758","Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.",0.01005,"2017-09-20T18:29:00.187+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2014-9758",{"cveId":2291,"releaseId":53,"cycle":54,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},"CVE-2016-6485","The __construct function in Framework\u002FEncryption\u002FCrypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.",0.00846,"2017-03-01T20:59:00.22+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2016-6485",{"cveId":2291,"releaseId":48,"cycle":49,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":42,"cycle":43,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":36,"cycle":37,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":30,"cycle":31,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":24,"cycle":25,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":16,"cycle":17,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":74,"cycle":75,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":67,"cycle":68,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2291,"releaseId":60,"cycle":61,"description":2292,"severity":162,"cvssScore":178,"epssScore":2293,"inKev":21,"publishedAt":2294,"url":2295},{"cveId":2306,"releaseId":67,"cycle":68,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},"CVE-2016-4010","Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.",0.92869,"2017-01-23T21:59:01.3+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2016-4010",{"cveId":2306,"releaseId":53,"cycle":54,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":48,"cycle":49,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":42,"cycle":43,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":36,"cycle":37,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":30,"cycle":31,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":24,"cycle":25,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":16,"cycle":17,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":74,"cycle":75,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2306,"releaseId":60,"cycle":61,"description":2307,"severity":722,"cvssScore":938,"epssScore":2308,"inKev":21,"publishedAt":2309,"url":2310},{"cveId":2321,"releaseId":53,"cycle":54,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},"CVE-2016-2212","The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app\u002Fcode\u002Fcore\u002FMage\u002FRss\u002FHelper\u002FOrder.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php\u002Frss\u002Forder\u002Fstatus.",0.02687,"2016-04-15T14:59:13.083+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2016-2212",{"cveId":2321,"releaseId":48,"cycle":49,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":42,"cycle":43,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":36,"cycle":37,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":30,"cycle":31,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":24,"cycle":25,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":16,"cycle":17,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":74,"cycle":75,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":67,"cycle":68,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2321,"releaseId":60,"cycle":61,"description":2322,"severity":99,"cvssScore":146,"epssScore":2323,"inKev":21,"publishedAt":2324,"url":2325},{"cveId":2336,"releaseId":16,"cycle":17,"description":2337,"severity":99,"cvssScore":785,"epssScore":2338,"inKev":21,"publishedAt":2339,"url":2340},"CVE-2015-3458","The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:\u002F\u002F stream wrapper, related to the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary ",0.06053,"2015-04-29T22:59:04.113+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-3458",{"cveId":2342,"releaseId":16,"cycle":17,"description":2343,"severity":99,"cvssScore":2344,"epssScore":2345,"inKev":21,"publishedAt":2346,"url":2347},"CVE-2015-3457","Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.",5,0.25054,"2015-04-29T22:59:03.253+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-3457",{"cveId":2349,"releaseId":16,"cycle":17,"description":2350,"severity":99,"cvssScore":785,"epssScore":2351,"inKev":21,"publishedAt":2352,"url":2353},"CVE-2015-1399","PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.",0.10001,"2015-04-29T22:59:02.407+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-1399",{"cveId":2355,"releaseId":16,"cycle":17,"description":2356,"severity":99,"cvssScore":785,"epssScore":2357,"inKev":21,"publishedAt":2358,"url":2359},"CVE-2015-1398","Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boun",0.14298,"2015-04-29T22:59:01.533+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-1398",{"cveId":2361,"releaseId":16,"cycle":17,"description":2362,"severity":99,"cvssScore":785,"epssScore":2363,"inKev":21,"publishedAt":2364,"url":2365},"CVE-2015-1397","SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.",0.56686,"2015-04-29T22:59:00.08+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2015-1397",{"cveId":2367,"releaseId":36,"cycle":37,"description":2368,"severity":99,"cvssScore":2369,"epssScore":2370,"inKev":21,"publishedAt":2371,"url":2372},"CVE-2011-5240","Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",5.8,0.00611,"2012-11-06T12:21:26.977+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2011-5240",{"cveId":2367,"releaseId":42,"cycle":43,"description":2368,"severity":99,"cvssScore":2369,"epssScore":2370,"inKev":21,"publishedAt":2371,"url":2372},{"cveId":2375,"releaseId":60,"cycle":61,"description":2376,"severity":99,"cvssScore":116,"epssScore":2377,"inKev":21,"publishedAt":2378,"url":2379},"CVE-2009-0541","Multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username field in an admin\u002F request to index.php, possibly related to the login[username] parameter and the app\u002Fcode\u002Fcore\u002FMage\u002FAdmin\u002FModel\u002FSession.php login function; (2) the email address field in an admin\u002Findex\u002Fforgotpassword\u002F request to index.php, possibly related to the email parameter and the app\u002Fcode\u002Fcore\u002FMage\u002FAdminhtml\u002Fcontrollers\u002FIndex",0.01806,"2009-02-25T16:30:00.467+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2009-0541","2"]