Adobe Adobe Commerce

Name: Adobe Adobe Commerce
Brand: Adobe

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

5critical28high28medium4low

updated 2026-10-27

vulnerabilities (190)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-34102US	—OT critical	100.0% (100th)	KEV	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2025-54236US	—OT critical	94.7% (100th)	KEV	no fix	2025-09-09	2 versions
CVE-2026-71362US	—OT critical	90.5% (100th)	KEV	2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug	2026-08-11	2 versions
CVE-2026-48356US	critical9.3	1.00% (63rd)	Exploit	2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul	2026-07-14	2 versions
CVE-2026-34648US	—	21.4% (98th)	—	no fix	2026-05-12	≤ 0 ≤2.4.4-p17
CVE-2025-24434US	—OT elevated	17.2% (97th)	—	no fix	2025-02-11	≤ 0 ≤2.4.8-beta1
CVE-2026-34650US	—	15.1% (97th)	—	no fix	2026-05-12	≤ 0 ≤2.4.4-p17
CVE-2026-34649US	—	13.6% (96th)	—	no fix	2026-05-12	≤ 0 ≤2.4.4-p17
CVE-2024-20720US	—	3.69% (90th)	—	no fix	2024-02-15	≤ 0 ≤2.4.4-p6
CVE-2021-36023US	high7.2	2.37% (84th)	—	no fix	2023-09-06	≤ 0 ≤2.3.7
CVE-2021-36036US	—	2.12% (82nd)	—	no fix	2023-09-06	≤ 0 ≤2.3.7
CVE-2021-36021US	—	2.01% (81st)	—	no fix	2023-09-06	≤ 0 ≤2.3.7
CVE-2024-39402US	—	1.67% (77th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2024-39401US	—	1.67% (77th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2022-24093US	high7.2	1.51% (74th)	—	no fix	2023-09-12	≤ 0 ≤2.3.7-p2
CVE-2024-34108US	high7.2	1.44% (73rd)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2024-20758US	critical9.0	1.42% (73rd)	—	no fix	2024-04-10	≤ 0 ≤2.4.7-beta3
CVE-2025-24406US	high7.5	1.40% (72nd)	—	no fix	2025-02-11	2 versions
CVE-2024-34110US	—	1.39% (72nd)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2024-34109US	—	1.39% (72nd)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2022-42344US	—OT elevated	1.32% (71st)	—	no fix	2022-10-20	≤ 0 ≤2.4.3-p2
CVE-2024-20719US	critical9.1	1.31% (70th)	—	no fix	2024-02-15	≤ 0 ≤2.4.4-p6
CVE-2024-34111US	high8.8	1.27% (70th)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2024-45115US	—	1.25% (69th)	—	no fix	2024-10-10	≤ 0 ≤2.4.4-p10
CVE-2026-48358US	critical9.1	1.21% (68th)	—	2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul	2026-07-14	2 versions
CVE-2024-34107US	critical9.8	1.13% (66th)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2024-39397US	—	1.10% (65th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2023-38207US	—	1.07% (65th)	—	no fix	2023-08-09	≤ 0 ≤2.4.4-p4
CVE-2025-27189US	—	1.03% (63rd)	—	no fix	2025-04-08	≤ 0 ≤2.4.8-beta2
CVE-2024-20759US	—	1.03% (63rd)	—	no fix	2024-04-10	≤ 0 ≤2.4.7-beta3
CVE-2023-29293US	—	1.01% (63rd)	—	no fix	2023-06-15	≤ 0 ≤2.4.4-p3
CVE-2026-47992US	—	0.99% (62nd)	—	2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul	2026-07-14	2 versions
CVE-2025-24408US	medium6.5	0.96% (61st)	—	no fix	2025-02-11	2 versions
CVE-2025-24418US	high8.1	0.96% (61st)	—	no fix	2025-02-11	≤ 0 ≤2.4.8-beta1
CVE-2024-45116US	—	0.94% (61st)	—	no fix	2024-10-10	≤ 0 ≤2.4.4-p10
CVE-2025-24411US	high8.1	0.91% (60th)	—	no fix	2025-02-11	≤ 0 ≤2.4.8-beta1
CVE-2024-39399US	high7.7	0.91% (60th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2024-34103US	—	0.91% (60th)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2024-45119US	—	0.88% (59th)	—	no fix	2024-10-10	≤ 0 ≤2.4.4-p10
CVE-2023-38218US	—OT elevated	0.88% (59th)	—	no fix	2023-10-13	≤ 0 ≤2.4.7-beta1
CVE-2025-49555US	—	0.88% (59th)	—	no fix	2025-08-12	2 versions
CVE-2026-47996US	medium6.8OT elevated	0.88% (59th)	—	2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul	2026-07-14	2 versions
CVE-2024-20716US	—	0.87% (59th)	—	no fix	2024-02-15	≤ 0 ≤2.4.4-p6
CVE-2024-39406US	medium6.8	0.87% (59th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2023-26366US	—	0.86% (58th)	—	no fix	2023-10-13	≤ 0 ≤2.4.7-beta1
CVE-2024-39398US	—	0.86% (58th)	—	no fix	2024-08-14	≤ 0 ≤2.4.4-p9
CVE-2024-45117US	—	0.85% (58th)	—	no fix	2024-10-10	≤ 0 ≤2.4.4-p10
CVE-2024-34106US	—OT elevated	0.85% (58th)	—	no fix	2024-06-13	≤ 0 ≤2.4.4-p8
CVE-2026-48416US	—OT elevated	0.83% (57th)	—	2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug	2026-08-11	2 versions
CVE-2023-38250US	medium6.6	0.83% (57th)	—	no fix	2023-10-13	≤ 0 ≤2.4.7-beta1

showing 50 of 190

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-863Incorrect Authorization43 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')38 CVEs
CWE-284Improper Access Control32 CVEs
CWE-285Improper Authorization22 CVEs
CWE-20Improper Input Validation16 CVEs
CWE-918Server-Side Request Forgery (SSRF)7 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6 CVEs
CWE-352Cross-Site Request Forgery (CSRF)6 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)190 CVEs
NLNCSC-NL (CSAF)14 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan