CVE-2026-128053

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the error pages because errors/processor.php prints URLs derived from SCRIPT_NAME without proper escaping. An unauthenticate...

EUVD-2026-125056

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...