Composer magento/project-community-edition has 161 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-54236 KEV | Magento Community Edition Improper Input Validation vulnerability | critical | 9.1 | <=2.0.2 | – |
| CVE-2025-24434 | Improper Authorization vulnerability in Magento and Adobe Commerce | critical | 9.1 | <=2.0.2 | – |
| CVE-2022-35698 | Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | critical | 10.0 | <=2.0.2 | – |
| CVE-2020-9631 | Magento security mitigation bypass vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9632 | Magento security mitigation bypass vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9691 | Magento DOM-based Cross-site scripting vulnerability | critical | 9.6 | <=2.0.2 | – |
| CVE-2020-9576 | Magento command injection vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9578 | Magento command injection vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9582 | Magento command injection vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9583 | Magento command injection vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2021-21030 | Magento stored cross-site scripting (XSS) in the customer address upload feature | high | 8.1 | <=2.0.2 | – |
| CVE-2020-24407 | Magento 2 Community Edition RCE via Unsafe File Upload | critical | 9.1 | <=2.0.2 | – |
| CVE-2020-9580 | Magento Security mitigation bypass vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2020-9587 | Magento authorization bypass vulnerability | high | 7.5 | <=2.0.2 | – |
| CVE-2020-9585 | Magento Defense-in-depth security mitigation vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2021-21016 | Magento OS command injection via the WebAPI | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-21014 | Magento vulnerable to a file upload restriction bypass | critical | 9.1 | <=2.0.2 | – |
| CVE-2020-9689 | Magento path traversal vulnerability | medium | 6.5 | <=2.0.2 | – |
| CVE-2020-9630 | Magento business logic error vulnerability | critical | 9.8 | <=2.0.2 | – |
| CVE-2024-20720 | Magento Open Source allows OS Command Injection | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36022 | Magento XML Injection vulnerability in the Widgets Update Layout | high | 7.2 | <=2.0.2 | – |
| CVE-2021-21025 | Magento XPath Injection | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36033 | Magento XML Injection vulnerability in the Widgets Module | critical | 0.0 | <=2.0.2 | – |
| CVE-2021-36031 | Magento Path Traversal vulnerability via the `theme[preview_image]` parameter | high | 0.0 | <=2.0.2 | – |
| CVE-2020-9588 | Magento Signature verification bypass | high | 7.2 | <=2.0.2 | – |
| CVE-2021-36024 | Magento is affected by an os command injection via the Data collection endpoint | high | 7.2 | <=2.0.2 | – |
| CVE-2021-36028 | Magento has an XML Injection vulnerability | critical | 0.0 | <=2.0.2 | – |
| CVE-2021-36040 | Magento has a file extension restrictions bypass | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36025 | Magento is affected by an improper input validation vulnerability while saving a customer's details | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36020 | Magento XML Injection vulnerability in the 'City' field | high | 0.0 | <=2.0.2 | – |
| CVE-2023-38208 | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36029 | Magento improper authorization vulnerability | high | 7.2 | <=2.0.2 | – |
| CVE-2021-36042 | Magento executes code via the API File Option Upload Extension | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-21020 | Magento Improper Access Control | medium | 5.3 | <=2.0.2 | – |
| CVE-2021-36034 | Magento affected by remote code execution via a file upload | high | 7.2 | <=2.0.2 | – |
| CVE-2021-36041 | Magento vulnerable to file upload attack | high | 7.2 | <=2.0.2 | – |
| CVE-2021-36023 | Magento XML Injection vulnerability in the Widgets Update Layout | critical | 9.1 | <=2.0.2 | – |
| CVE-2020-24401 | Magento 2 Community Edition Incorrect Authorization | medium | 6.5 | <=2.0.2 | – |
| CVE-2021-36030 | Magento allows attackers to alter the price of items | high | 0.0 | <=2.0.2 | – |
| CVE-2021-36032 | Magento is affected by an improper input validation vulnerability | high | 8.8 | <=2.0.2 | – |
| CVE-2021-21022 | Magento Insecure Direct Object Reference (IDOR) in the product module | medium | 5.3 | <=2.0.2 | – |
| CVE-2021-36036 | Magento improper access control vulnerability within Magento's Media Gallery Upload workflow | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36012 | Magento affected by a business logic error in the placeOrder graphql mutation | medium | 6.5 | <=2.0.2 | – |
| CVE-2021-36044 | Magento affected by a server-side denial-of-service using a GraphQL field | high | 7.5 | <=2.0.2 | – |
| CVE-2021-36021 | Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | critical | 9.1 | <=2.0.2 | – |
| CVE-2021-36043 | Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension | high | 8.0 | <=2.0.2 | – |
| CVE-2021-28583 | Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats | high | 7.5 | <=2.0.2 | – |
| CVE-2019-8114 | Magento 2 Community Edition RCE Vulnerability | high | 7.2 | <1.9.4.3 | 1.9.4.3 |
| CVE-2021-21026 | Magento improper authorization vulnerability in the integrations module | medium | 5.3 | <=2.0.2 | – |
| CVE-2021-36037 | Magento is affected by an improper authorization vulnerability | medium | 6.5 | <=2.0.2 | – |
| CVE-2021-36038 | Magento discloses sensitive information via the Multishipping Module | medium | 6.5 | <=2.0.2 | – |
| CVE-2021-28584 | Magento Path Traversal vulnerability | medium | 5.4 | <=2.0.2 | – |
| CVE-2021-36039 | Magento discloses sensitive information | medium | 6.5 | <=2.0.2 | – |
| CVE-2020-24402 | Magento incorrect permissions vulnerability in the Integrations component | medium | 4.9 | <=2.0.2 | – |
| CVE-2021-36026 | Magento stored cross-site scripting vulnerability in the customer address upload feature | medium | 0.0 | <=2.0.2 | – |
| CVE-2021-21031 | Magento Insufficient Session Expiration | medium | 5.6 | <=2.0.2 | – |
| CVE-2024-39401 | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | <=2.0.2 | – |
| CVE-2024-39402 | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | <=2.0.2 | – |
| CVE-2021-21027 | Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API | medium | 4.3 | <=2.0.2 | – |
| CVE-2020-24403 | Magento incorrect user permissions vulnerability within the Inventory component | low | 2.7 | <=2.0.2 | – |
| CVE-2021-39864 | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 6.5 | <=2.0.2 | – |
| CVE-2021-21023 | Magento stored cross-site scripting vulnerability in the admin console | medium | 4.8 | <=2.0.2 | – |
| CVE-2021-28585 | Magento Improper input validation vulnerability | medium | 5.3 | <=2.0.2 | – |
| CVE-2021-21032 | Magento Insufficient Session Expiration | medium | 5.6 | <=2.0.2 | – |
| CVE-2022-24093 | Magento Open Source affected by Improper Input Validation | high | 7.2 | <=2.0.2 | – |
| CVE-2020-9577 | Magento stored cross-site scripting vulnerability | medium | 6.1 | <=2.0.2 | – |
| CVE-2020-9581 | Magento stored cross-site scripting vulnerability | medium | 6.1 | <=2.0.2 | – |
| CVE-2024-20758 | Magento Open Source allows Improper Input Validation | critical | 9.0 | <=2.0.2 | – |
| CVE-2022-35689 | Magento Open Source allows Improper Access Control | medium | 5.3 | <=2.0.2 | – |
| CVE-2021-36027 | Magento stored cross-site scripting vulnerability | medium | 0.0 | <=2.0.2 | – |
| CVE-2021-28556 | Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies | medium | 6.9 | <=2.0.2 | – |
| CVE-2025-24406 | Adobe Commerce Path Traversal | high | 7.5 | <=2.0.2 | – |
| CVE-2023-29297 | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | <=2.0.2 | – |
| CVE-2024-20719 | Magento Open Source allows Cross-Site Scripting (XSS) | critical | 9.1 | <=2.0.2 | – |
| CVE-2020-9584 | Magento Stored cross-site scripting | medium | 5.4 | <=2.0.2 | – |
| CVE-2023-29291 | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | <=2.0.2 | – |
| CVE-2023-38207 | Magento Open Source allows XML Injection | medium | 5.3 | <=2.0.2 | – |
| CVE-2024-20759 | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.1 | <=2.0.2 | – |
| CVE-2023-22248 | Magento Open Source affected by Improper Input Validation | high | 7.5 | <=2.0.2 | – |
| CVE-2023-29293 | Magento Open Source affected by Improper Input Validation | low | 2.7 | <=2.0.2 | – |
| CVE-2023-38209 | Magento Open Source allows Incorrect Authorization | medium | 6.5 | <=2.0.2 | – |
| CVE-2025-24408 | Magento Information Exposure vulnerability | medium | 6.5 | <=2.0.2 | – |
| CVE-2023-22250 | Magento Open Source allows Improper Access Control | medium | 5.3 | <=2.0.2 | – |
| CVE-2023-29292 | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | <=2.0.2 | – |
| CVE-2023-22247 | Magento Open Source allows XML Injection | high | 7.5 | <=2.0.2 | – |
| CVE-2025-24411 | Magento Improper Access Control vulnerability | high | 8.1 | <=2.0.2 | – |
| CVE-2024-39399 | Magento Path Traversal vulnerability | high | 7.7 | <=2.0.2 | – |
| CVE-2023-38218 | Magento Open Source allows Incorrect Authorization | high | 8.8 | <=2.0.2 | – |
| CVE-2025-49555 | Magento Cross-Site Request Forgery (CSRF) vulnerability | high | 8.1 | <=2.0.2 | – |
| CVE-2023-29289 | Magento Open Source allows XML Injection | medium | 6.5 | <=2.0.2 | – |
| CVE-2024-20716 | Magento Open Source allows Uncontrolled Resource Consumption | medium | 4.9 | <=2.0.2 | – |
| CVE-2023-26366 | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 6.8 | <=2.0.2 | – |
| CVE-2024-39398 | Magento does not properly restrict excessive authentication attempts | high | 7.4 | <=2.0.2 | – |
| CVE-2016-6485 | Unauthenticated crypto and weak IV in Magento\Framework\Encryption | high | 7.5 | >=2.0 and <=2.0.2 | – |
| CVE-2022-35692 | Magento Open Source has Improper Access Control vulnerability | medium | 5.3 | <=2.0.2 | – |
| CVE-2023-38221 | Magento Open Source allows SQL Injection | high | 8.0 | <=2.0.2 | – |
| CVE-2023-38249 | Magento Open Source allows SQL Injection | high | 8.0 | <=2.0.2 | – |
| CVE-2023-38250 | Magento Open Source allows SQL Injection | high | 8.0 | <=2.0.2 | – |
| CVE-2021-28567 | Magento Improper Authorization vulnerability in the customers module | medium | 5.0 | <=2.0.2 | – |
| CVE-2023-38220 | Magento Open Source allows Improper Authorization | high | 7.5 | <=2.0.2 | – |
| CVE-2023-26367 | Magento Open Source has Improper Input Validation Vulnerability | medium | 4.9 | <=2.0.2 | – |
| CVE-2025-24438 | Magento stored Cross-Site Scripting (XSS) vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24424 | Magento Improper Access Control vulnerability | medium | 6.5 | <=2.0.2 | – |
| CVE-2024-20718 | Magento Open Source allows Cross-Site Request Forgery (CSRF) | medium | 4.3 | <=2.0.2 | – |
| CVE-2023-38251 | Magento Open Source allows Uncontrolled Resource Consumption | medium | 5.3 | <=2.0.2 | – |
| CVE-2023-38219 | Magento Open Source allows Cross-Site Scripting (XSS) | high | 8.7 | <=2.0.2 | – |
| CVE-2023-29294 | Magento Open Source has Business Logic Errors Vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2023-29287 | Magento Open Source allows Information Exposure | medium | 5.3 | <=2.0.2 | – |
| CVE-2025-24410 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24412 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24413 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24414 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24415 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24416 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24417 | Magento Stored Cross-Site Scripting (XSS) Vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2024-39400 | Magento DOM-based Cross-Site Scripting (XSS) vulnerability | high | 8.1 | <=2.0.2 | – |
| CVE-2025-24409 | Adobe Commerce Improper Authorization vulnerability | high | 8.2 | <=2.0.2 | – |
| CVE-2025-49559 | Magento vulnerable to path traversal | medium | 5.3 | <=2.0.2 | – |
| CVE-2023-29288 | Magento Open Source allows Incorrect Authorization | medium | 4.3 | <=2.0.2 | – |
| CVE-2023-29295 | Magento Open Source allows Incorrect Authorization | medium | 4.3 | <=2.0.2 | – |
| CVE-2023-29296 | Magento Open Source allows Incorrect Authorization | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-49557 | Magento Cross-site Scripting vulnerability | high | 8.7 | <=2.0.2 | – |
| CVE-2025-24425 | Magento Business Logic Error vulnerability | medium | 5.3 | <=2.0.2 | – |
| CVE-2025-24427 | Magento Improper Access Control vulnerability | medium | 6.5 | <=2.0.2 | – |
| CVE-2023-29290 | Magento Open Source allows Incorrect Authorization | medium | 5.3 | <=2.0.2 | – |
| CVE-2025-54264 | Magento vulnerable to stored Cross-Site Scripting (XSS) | high | 8.1 | <=2.0.2 | – |
| CVE-2025-54263 | Magento provides incorrect authorization through a security feature bypass | high | 8.1 | <=2.0.2 | – |
| CVE-2025-49556 | Magento has incorrect authorization issue that leads to arbitrary file system read | high | 7.5 | <=2.0.2 | – |
| CVE-2023-22251 | Magento Open Source allows Incorrect Authorization | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-49554 | Magento vulnerable to denial of service | high | 7.5 | <=2.0.2 | – |
| CVE-2025-54265 | Magento allows incorrect authorization | medium | 5.9 | <=2.0.2 | – |
| CVE-2025-24421 | Magento Incorrect Authorization vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-24436 | Magento Improper Access Control vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-27190 | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | <=2.0.2 | – |
| CVE-2024-39403 | Magento Stored Cross-Site Scripting (XSS) vulnerability | high | 7.6 | <=2.0.2 | – |
| CVE-2025-43585 | Magento Improper Authorization leading to security feature bypass | high | 8.2 | <=2.0.2 | – |
| CVE-2025-24435 | Magento Improper Access Control vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-24429 | Magento Improper Access Control vulnerability | low | 3.5 | <=2.0.2 | – |
| CVE-2025-27191 | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | <=2.0.2 | – |
| CVE-2025-27192 | Magento does not properly protect credentials | low | 2.7 | <=2.0.2 | – |
| CVE-2025-27206 | Magento Improper Access Control leads to security feature bypass | medium | 5.3 | <=2.0.2 | – |
| CVE-2024-39404 | Magento Improper Authorization vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-24437 | Magento Improper Access Control vulnerability | medium | 5.4 | <=2.0.2 | – |
| CVE-2024-39411 | Magento Improper Authorization leads to security feature bypass | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39413 | Magento Improper Authorization vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39414 | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39415 | Magento Improper Authorization Leading to Security feature bypass | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39417 | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-54267 | Magento vulnerable to privilege escalation due to incorrect authorization | medium | 6.5 | <=2.0.2 | – |
| CVE-2024-39405 | Magento Improper Authorization vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39407 | Magento Improper Authorization vulnerability | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39419 | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | <=2.0.2 | – |
| CVE-2024-39416 | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-24428 | Magento stored Cross-Site Scripting (XSS) vulnerability | medium | 5.4 | <=2.0.2 | – |
| CVE-2024-39418 | Magento Improper Authorization vulnerability | medium | 5.4 | <=2.0.2 | – |
| CVE-2025-49558 | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 5.9 | <=2.0.2 | – |
| CVE-2025-24430 | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | <=2.0.2 | – |
| CVE-2025-24432 | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | <=2.0.2 | – |
| CVE-2025-49549 | Magento Authenticated Security feature bypass | low | 2.7 | <=2.0.2 | – |
| CVE-2025-49550 | Magento Security feature bypass | medium | 4.3 | <=2.0.2 | – |
| CVE-2025-54266 | Magento vulnerable to stored Cross-Site Scripting (XSS) | medium | 4.8 | <=2.0.2 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked