CVE-2026-128052

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's layout directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the block directive applies. Administrators...

CVE-2026-128053

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...

CVE-2026-128047

OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5uniqid and customer and administrator password-reset tokens with the non-cryptographic uniqHash. Unauthenticated attackers can brute-force the roughly 20-bit...

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can...

CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequentia...

CVE-2026-128044

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauthcallback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to...

CVE-2026-128046

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protectedextensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom...

CVE-2026-128048

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, an...

CVE-2026-128051

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a...

CVE-2026-128033

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in MageRssModelResourceOrder::getAllCommentCollection, which omits the isvisibleonfront filter for invoice, shipment and credit-memo comments. Authenticated customers can open...

CVE-2026-128032

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free No Payment Information Required payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via...

CVE-2026-128041

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that...

CVE-2026-128043

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

CVE-2026-128031

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators...

CVE-2026-128040

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator...

CVE-2026-128042

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because MageSalesRuleModelValidator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated...

CVE-2026-128028

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list...

CVE-2026-128029

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store,...

CVE-2026-128030

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding...

CVE-2023-54423

OpenMage magento-lts versions before 20.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that the TinyMCE WYSIWYG editor fails to adequately filter scripts within specially crafted HTML tags. An attacker can inject an element containing a malicious onmouseover at...