HIGHPackagist
GHSA-26rr-v2j2-25fh· CVE-2021-32758Layout XML Arbitrary Code Fix
Modified: 7/8/2026
package
Packagist/openmage/magento-lts
pkg:packagist/openmage/magento-lts
CRITICALPackagist
GHSA-2cwr-gcf9-pvxr· CVE-2026-42155Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
Modified: 5/16/2026
HIGH8.8Packagist
GHSA-3j5q-7q7h-2hhv· CVE-2026-40488OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Modified: 5/5/2026
MEDIUM4.9Packagist
GHSA-3p73-mm7v-4f6m· CVE-2023-23617DoS vulnerability in MaliciousCode filter
Modified: 9/10/2026
HIGH8.8Packagist
GHSA-5j2g-3ph4-rgvm· CVE-2021-41144Fix for authenticated remote code execution through layout update
Modified: 7/8/2026
LOW2.9Packagist
GHSA-5pxh-89cx-4668· CVE-2025-27400Magento LTS vulnerable to stored XSS in theme config fields
Modified: 3/3/2025
HIGH7.2Packagist
GHSA-5vpv-xmcj-9q85· CVE-2021-41143Fix for arbitrary file deletion in customer media allows for remote code execution
Modified: 7/8/2026
MEDIUM4.1Packagist
GHSA-5vrp-638w-p8m2· CVE-2024-41676Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-665x-ppc4-685w· CVE-2026-40098OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Modified: 5/5/2026
MEDIUM4.9Packagist
GHSA-6vqf-6fhm-7rc6· CVE-2026-25525OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
Modified: 4/21/2026
HIGH7.5Packagist
GHSA-9358-cpvx-c2qp· CVE-2023-41879Magento LTS's guest order "protect code" can be brute-forced too easily
Modified: 2/16/2024
HIGH7.5Packagist
GHSA-9j5w-2cqc-cwj9Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
Modified: 12/4/2024
HIGH7.2Packagist
GHSA-c9q3-r4rv-mjm7· CVE-2021-39217Fix for arbitrary command execution in custom layout update through blocks
Modified: 7/8/2026
HIGH8.0Packagist
GHSA-crf2-xm6x-46p6· BIT-magento-2020-15151, CVE-2020-15151Observable Timing Discrepancy in OpenMage LTS
Modified: 7/8/2026
HIGH8.1Packagist
GHSA-fg79-cr9c-7369· CVE-2026-25524OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Modified: 4/21/2026
CRITICAL9.1Packagist
GHSA-fvrf-9428-527m· CVE-2021-21427Backport for CVE-2021-21024 Blind SQLi from Magento 2
Modified: 7/8/2026
MEDIUM5.4Packagist
GHSA-gp6m-fq6h-cjcxMagento LTS vulnerable to stored XSS in admin file form
Modified: 11/30/2024
HIGH7.2Packagist
GHSA-h632-p764-pjqm· CVE-2021-41231DataFlow upload remote code execution vulnerability
Modified: 7/8/2026
MEDIUM5.3Packagist
GHSA-jg68-vhv3-9r8f· CVE-2026-25523Magento's X-Original-Url header can expose admin url
Modified: 2/10/2026
HIGH8.0Packagist
GHSA-jrgf-vfw2-hj26· CVE-2020-15244RCE via PHP Object injection via SOAP Requests
Modified: 7/8/2026
CRITICAL9.8Packagist
GHSA-m496-x567-f98c· CVE-2021-21426Fixes a bug in Zend Framework's Stream HTTP Wrapper
Modified: 7/8/2026
MEDIUM6.1Packagist
GHSA-qpgq-5g92-j5q8· CVE-2026-42207Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
Modified: 5/16/2026
MEDIUMPackagist
GHSA-qv78-c8hc-438r· CVE-2025-64174OpenMage vulnerable to XSS in Admin Notifications
Modified: 11/6/2025
MEDIUM4.3Packagist
GHSA-r3c9-9j5q-pwv4· CVE-2021-21395magento-lts Reset Password not protected against well-timed CSRF
Modified: 7/8/2026
MEDIUMPackagist
GHSA-x8jv-q8j2-487c· CVE-2026-42458Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Modified: 5/16/2026
HIGHPackagist
GHSA-xm9f-vxmx-4m58· CVE-2021-32759Data Flow Sanitation Issue Fix
Modified: 7/8/2026