Composer openmage/magento-lts has 26 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-32758 | Layout XML Arbitrary Code Fix | high | 0.0 | <19.4.15 or >=20.0.0 and <20.0.13 | 19.4.15, 20.0.13 |
| CVE-2021-32759 | Data Flow Sanitation Issue Fix | high | 0.0 | <19.4.15 or >=20.0.0 and <20.0.13 | 19.4.15, 20.0.13 |
| CVE-2021-39217 | Fix for arbitrary command execution in custom layout update through blocks | high | 7.2 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2021-41143 | Fix for arbitrary file deletion in customer media allows for remote code execution | high | 7.2 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2020-15244 | RCE via PHP Object injection via SOAP Requests | high | 8.0 | <19.4.8 or >=20.0.0 and <20.0.4 | 19.4.8, 20.0.4 |
| CVE-2023-41879 | Magento LTS's guest order "protect code" can be brute-forced too easily | high | 7.5 | <19.5.1 or >=20.0.0 and <20.1.1 | 19.5.1, 20.1.1 |
| CVE-2021-41231 | DataFlow upload remote code execution vulnerability | high | 7.2 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2021-21426 | Fixes a bug in Zend Framework's Stream HTTP Wrapper | critical | 9.8 | <19.4.13 or >=20.0.0 and <20.0.9 | 19.4.13, 20.0.9 |
| CVE-2021-41144 | Fix for authenticated remote code execution through layout update | high | 8.8 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2021-21427 | Backport for CVE-2021-21024 Blind SQLi from Magento 2 | critical | 9.1 | <19.4.13 or >=20.0.0 and <20.0.9 | 19.4.13, 20.0.9 |
| CVE-2023-23617 | DoS vulnerability in MaliciousCode filter | medium | 4.9 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2020-15151 | Observable Timing Discrepancy in OpenMage LTS | high | 8.0 | <19.4.6 or >=20.0.0 and <20.0.2 | 19.4.6, 20.0.2 |
| CVE-2026-40488 | OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution | high | 8.8 | <20.17.0 | 20.17.0 |
| CVE-2026-25524 | OpenMage LTS: Phar Deserialization leads to Remote Code Execution | high | 8.1 | <20.17.0 | 20.17.0 |
| CVE-2026-25525 | OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module | medium | 4.9 | <20.17.0 | 20.17.0 |
| CVE-2021-21395 | magento-lts Reset Password not protected against well-timed CSRF | medium | 4.3 | <19.4.22 or >=20.0.0 and <20.0.19 | 19.4.22, 20.0.19 |
| CVE-2026-42155 | Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs | critical | 0.0 | <20.18.0 | 20.18.0 |
| CVE-2024-41676 | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs | medium | 4.1 | <20.10.1 | 20.10.1 |
| CVE-2026-25523 | Magento's X-Original-Url header can expose admin url | medium | 5.3 | <20.16.1 | 20.16.1 |
| CVE-2026-42458 | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | medium | 0.0 | <20.18.0 | 20.18.0 |
| CVE-2025-27400 | Magento LTS vulnerable to stored XSS in theme config fields | low | 2.9 | <20.12.3 | 20.12.3 |
| CVE-2025-64174 | OpenMage vulnerable to XSS in Admin Notifications | medium | 0.0 | <20.16.0 | 20.16.0 |
| CVE-2026-40098 | OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure | medium | 5.4 | <20.17.0 | 20.17.0 |
| CVE-2026-42207 | Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` | medium | 6.1 | <20.18.0 | 20.18.0 |
| GHSA-9j5w-2cqc-cwj9 | Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor | high | 7.5 | <20.2.0 | 20.2.0 |
| GHSA-gp6m-fq6h-cjcx | Magento LTS vulnerable to stored XSS in admin file form | medium | 5.4 | >=20.0.0 and <20.5.0 or <19.5.3 | 20.5.0, 19.5.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked