Advisories · Technology

Adobe Commerce.

Every CVE that names Adobe Commerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-95631 CVE record

CVSS 8.7 High

Adobe Commerce | Improper Input Validation (CWE-20)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-103849 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- Adobe Commerce
- Adobe Commerce B2B
- Code injection
Not analysed yet 13 Oct 2026
CVE-2026-92910 CVE record

CVSS 7.2 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-91013 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92464 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Adobe Commerce | Improper Input Validation (CWE-20)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-95630 CVE record

CVSS 4.3 Medium

Adobe Commerce | Improper Input Validation (CWE-20)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-92922 CVE record

CVSS 8.1 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92908 CVE record

CVSS 8.3 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-92909 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-100133 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92911 CVE record

CVSS 8.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-76200 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-76201 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-77109 CVE record

CVSS 8.6 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-77110 CVE record

CVSS 7.6 High

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe Commerce
- Adobe Commerce B2B
- Path traversal
Not analysed yet 8 Sept 2026
CVE-2026-77108 CVE record

CVSS 7.5 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-76202 CVE record

CVSS 8.2 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-77774 CVE record

CVSS 8.6 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-77111 CVE record

CVSS 8.7 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-75650 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- Adobe Commerce
- Adobe Commerce B2B
- Code injection
Not analysed yet 7 Sept 2026
CVE-2026-48414 CVE record

CVSS 7.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 11 Aug 2026
CVE-2026-48416 CVE record

CVSS 7.5 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-48413 CVE record

CVSS 8.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 11 Aug 2026
CVE-2026-48415 CVE record

CVSS 7.6 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-48412 CVE record

CVSS 2.7 Low

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-48411 CVE record

CVSS 6.5 Medium

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-71362 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-47984 CVE record

CVSS 8.2 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-47997 CVE record

CVSS 5.9 Medium

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-47988 CVE record

CVSS 8.6 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-47999 CVE record

CVSS 4.8 Medium

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-48358 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-116
Not analysed yet 14 Jul 2026
CVE-2026-48356 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Adobe Commerce
- Adobe Commerce B2B
- Unrestricted file upload
Not analysed yet 14 Jul 2026
CVE-2026-47998 CVE record

CVSS 5.9 Medium

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-48000 CVE record

CVSS 6.1 Medium

Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
- Adobe Commerce
- Adobe Commerce B2B
- Open redirect
Not analysed yet 14 Jul 2026
CVE-2026-47995 CVE record

CVSS 8.1 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-48001 CVE record

CVSS 3.7 Low

Adobe Commerce | Information Exposure (CWE-200)
- Adobe Commerce
- Adobe Commerce B2B
- Information disclosure
Not analysed yet 14 Jul 2026
CVE-2026-48371 CVE record

CVSS 5.4 Medium

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-47996 CVE record

CVSS 6.8 Medium

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-47994 CVE record

CVSS 8.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-47992 CVE record

CVSS 7.2 High

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Commerce
- Adobe Commerce B2B
- SQL injection
Not analysed yet 14 Jul 2026
CVE-2026-34656 CVE record

CVSS 4.3 Medium

Adobe Commerce | Improper Authorization (CWE-285)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-34658 CVE record

CVSS 4.8 Medium

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 12 May 2026
CVE-2026-34650 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- Adobe Commerce
- Adobe Commerce B2B
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-34686 CVE record

CVSS 8.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 12 May 2026
CVE-2026-34647 CVE record

CVSS 7.4 High

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Commerce
- Adobe Commerce B2B
- Server-side request forgery (SSRF)
Not analysed yet 12 May 2026
CVE-2026-34685 CVE record

CVSS 3.4 Low

Adobe Commerce | Improper Input Validation (CWE-20)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-20
Not analysed yet 12 May 2026
CVE-2026-34653 CVE record

CVSS 8.7 High

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe Commerce
- Adobe Commerce B2B
- Path traversal
Not analysed yet 12 May 2026
CVE-2026-34652 CVE record

CVSS 7.5 High

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-1395
Not analysed yet 12 May 2026
CVE-2026-34645 CVE record

CVSS 7.5 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-34648 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- Adobe Commerce
- Adobe Commerce B2B
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-34649 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- Adobe Commerce
- Adobe Commerce B2B
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-34655 CVE record

CVSS 4.8 Medium

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 12 May 2026
CVE-2026-34654 CVE record

CVSS 5.3 Medium

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-1395
Not analysed yet 12 May 2026
CVE-2026-34651 CVE record

CVSS 7.5 High

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
- Adobe Commerce
- Adobe Commerce B2B
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-34646 CVE record

CVSS 7.5 High

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-21291 CVE record

CVSS 4.8 Medium

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 11 Mar 2026
CVE-2026-21293 CVE record

CVSS 5.5 Medium

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Commerce
- Adobe Commerce B2B
- Server-side request forgery (SSRF)
Not analysed yet 11 Mar 2026
CVE-2026-21282 CVE record

CVSS 5.3 Medium

Adobe Commerce | Improper Input Validation (CWE-20)
- Adobe Commerce
- Adobe Commerce B2B
- CWE-20
Not analysed yet 11 Mar 2026
CVE-2026-21286 CVE record

CVSS 5.3 Medium

Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
Not analysed yet 11 Mar 2026