phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is magento/core vulnerable?

Composer magento/core has 24 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.

24advisories
11critical
0on CISA KEV
2no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2020-9664Magento php object injection vulnerabilitycritical9.8<=1.9.4.5–
CVE-2020-9631Magento security mitigation bypass vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9632Magento security mitigation bypass vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2015-6497Magento arbitrary PHP code execution via the productData parameterhigh8.8<1.9.2.11.9.2.1
CVE-2020-9576Magento command injection vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9578Magento command injection vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9582Magento command injection vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9583Magento command injection vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9579Magento Security mitigation bypass vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9580Magento Security mitigation bypass vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9587Magento authorization bypass vulnerabilityhigh7.5<1.9.4.51.9.4.5
CVE-2020-9585Magento Defense-in-depth security mitigation vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9630Magento business logic error vulnerabilitycritical9.8<1.9.4.51.9.4.5
CVE-2020-9591Magento defense-in-depth security mitigation vulnerabilityhigh7.5<1.9.4.51.9.4.5
CVE-2020-3719Magento sql injection vulnerabilityhigh7.5<1.9.4.41.9.4.4
CVE-2020-9588Magento Signature verification bypasshigh7.2<1.9.4.51.9.4.5
CVE-2020-3715Magento stored cross-site scripting vulnerabilitymedium6.1<1.9.4.41.9.4.4
CVE-2020-9577Magento stored cross-site scripting vulnerabilitymedium6.1<1.9.4.51.9.4.5
CVE-2020-9581Magento stored cross-site scripting vulnerabilitymedium6.1<1.9.4.51.9.4.5
CVE-2020-9665Magento stored cross-site scripting vulnerabilitymedium6.1<=1.9.4.5–
CVE-2019-8230Magento Remote code execution through support/output path modificationhigh7.2<1.9.4.31.9.4.3
CVE-2019-8231Magento Remote code execution through catalog attribute setshigh7.2<1.9.4.31.9.4.3
CVE-2020-9584Magento Stored cross-site scriptingmedium5.4<1.9.4.51.9.4.5
CVE-2019-8227Magento XSS Vulnerabilitymedium4.8<1.9.4.31.9.4.3

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.