.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/project-community-edition vulnerabilities

161 known advisories · Dependencies not checked · showing 61 more

SEVERITYADVISORYPUBLISHED

MediumMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-wcmw-8xpp-rwfjCVE-2025-49558Affected <=2.0.2OSV source ↗last year

MediumMagento Insufficient Session ExpirationGHSA-4h3p-63x6-vwg2BIT-magento-2021-21031CVE-2021-21031Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Insufficient Session ExpirationGHSA-4jfq-f8hc-775qBIT-magento-2021-21032CVE-2021-21032Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-469f-wf4f-3jjvCVE-2025-24437Affected <=2.0.2OSV source ↗2 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-mm87-rrqx-94crCVE-2025-24428Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-gvgf-pvh5-vjh4CVE-2024-39418Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Path Traversal vulnerabilityGHSA-7gpv-xrjr-f5h4BIT-magento-2021-28584CVE-2021-28584Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Stored cross-site scriptingGHSA-45h4-6gcj-6hwvBIT-magento-2020-9584CVE-2020-9584Affected <=2.0.2OSV source ↗4 years ago

MediumMagento vulnerable to path traversalGHSA-h4f4-gv6h-x824CVE-2025-49559Affected <=2.0.2OSV source ↗last year

MediumMagento Improper Access Control leads to security feature bypassGHSA-g2pj-xmxq-3r9qCVE-2025-27206Affected <=2.0.2OSV source ↗last year

MediumMagento Improper Access Control leads to Security feature bypassGHSA-6wq7-cg9h-mj6qCVE-2025-27190Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Access Control leads to Security feature bypassGHSA-vhcq-4xrm-2cr2CVE-2025-27191Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Business Logic Error vulnerabilityGHSA-6ff8-jrfg-43hhCVE-2025-24425Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-7pfc-834q-h497CVE-2023-38251Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-rpv2-g4pc-wp72CVE-2023-38207Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Information ExposureGHSA-85m4-g9vq-xpxjCVE-2023-29287Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-qw5m-vmp3-f553CVE-2023-29290Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-4h7p-4vq8-g2ghCVE-2023-22250Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-5fxx-jwjm-x9hjCVE-2022-35689Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Open Source has Improper Access Control vulnerabilityGHSA-gm4m-9rm8-7rxjCVE-2022-35692Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Improper input validation vulnerabilityGHSA-c38m-9668-6j2wBIT-magento-2021-28585CVE-2021-28585Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Insecure Direct Object Reference (IDOR) in the product moduleGHSA-8pfq-g48p-x7w8BIT-magento-2021-21022CVE-2021-21022Affected <=2.0.2OSV source ↗4 years ago

MediumMagento improper authorization vulnerability in the integrations moduleGHSA-crjc-2v9m-8w7rBIT-magento-2021-21026CVE-2021-21026Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Improper Access ControlGHSA-2j6v-829g-885qBIT-magento-2021-21020CVE-2021-21020Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerability in the customers moduleGHSA-cc3w-r3w8-hfh7BIT-magento-2021-28567CVE-2021-28567Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-c9h9-h5gf-885rCVE-2024-20716Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source has Improper Input Validation VulnerabilityGHSA-9mx6-4gg4-85xjCVE-2023-26367Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-4588-7x48-jrgjCVE-2023-29292Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-5f79-vhr4-vw2rCVE-2023-29291Affected <=2.0.2OSV source ↗3 years ago

MediumMagento incorrect permissions vulnerability in the Integrations componentGHSA-hvf5-4jr9-fghhBIT-magento-2020-24402CVE-2020-24402Affected <=2.0.2OSV source ↗4 years ago

MediumMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-pcrx-r49h-x2w5CVE-2025-54266Affected <=2.0.2OSV source ↗last year

MediumMagento stored cross-site scripting vulnerability in the admin consoleGHSA-h5rm-m772-6qcxBIT-magento-2021-21023CVE-2021-21023Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Security feature bypassGHSA-8hcx-xvww-6c6hCVE-2025-49550Affected <=2.0.2OSV source ↗last year

MediumMagento Improper Access Control vulnerabilityGHSA-82p4-55gj-956pCVE-2025-24435Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-ghpr-6qhr-rpp8CVE-2025-24436Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Incorrect Authorization vulnerabilityGHSA-v6r2-425c-hfrrCVE-2025-24421Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xgg-rw35-7mv5CVE-2024-39416Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xmj-f664-hv98CVE-2024-39417Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-74w7-cr4v-wf2vCVE-2024-39419Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-8w5f-8992-g86jCVE-2024-39413Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-cjm6-8mw8-2f8cCVE-2024-39407Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization Leading to Security feature bypassGHSA-gj93-84g5-mcjqCVE-2024-39415Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to security feature bypassGHSA-qm77-mqf3-fmhqCVE-2024-39411Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-x6f9-hv9r-fgq4CVE-2024-39414Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-5g9f-7gqc-8hj4CVE-2024-39405Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-qrh3-vxjg-h9h6CVE-2024-39404Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Open Source allows Cross-Site Request Forgery (CSRF)GHSA-hqgj-4396-hmxvCVE-2024-20718Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source has Business Logic Errors VulnerabilityGHSA-28vp-39rf-3q2jCVE-2023-29294Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-354h-fpmq-68v7CVE-2023-29295Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-3qr4-w96f-672vCVE-2023-29296Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-f989-3fp9-q3r2CVE-2023-29288Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-2wm7-mmgc-qxr3CVE-2023-22251Affected <=2.0.2OSV source ↗4 years ago

MediumMagento cross-site request forgery (CSRF) vulnerability via the GraphQL APIGHSA-h4xc-577p-hgj9BIT-magento-2021-21027CVE-2021-21027Affected <=2.0.2OSV source ↗4 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-6w27-c66f-gvhqCVE-2025-24430Affected <=2.0.2OSV source ↗2 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-7jmr-43qj-pw47CVE-2025-24432Affected <=2.0.2OSV source ↗2 years ago

LowMagento Improper Access Control vulnerabilityGHSA-656q-fx2w-8ccvCVE-2025-24429Affected <=2.0.2OSV source ↗2 years ago

LowMagento Authenticated Security feature bypassGHSA-85jx-x9r4-45m2CVE-2025-49549Affected <=2.0.2OSV source ↗last year

LowMagento does not properly protect credentialsGHSA-2r94-wm5v-4prxCVE-2025-27192Affected <=2.0.2OSV source ↗2 years ago

LowMagento Open Source affected by Improper Input ValidationGHSA-66c9-xrwj-9xv6CVE-2023-29293Affected <=2.0.2OSV source ↗3 years ago

LowMagento incorrect user permissions vulnerability within the Inventory componentGHSA-39rw-4m66-82gfBIT-magento-2020-24403CVE-2020-24403Affected <=2.0.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-crv7-r357-gw3wCVE-2019-8114Affected <1.9.4.3Fixed in 1.9.4.3OSV source ↗4 years ago