# openmage/magento-lts (Packagist) vulnerabilities

Source: https://junglewise.ai/threats/technologies/openmage-magento-lts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/openmage-magento-lts.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 26 vulnerabilities in openmage/magento-lts (Packagist): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-42458, was published on 15 May 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 26 (1 critical, 0 exploited in the wild)

## About openmage/magento-lts (Packagist)

OpenMage LTS is a maintained fork of Magento 1.x, an open-source e-commerce platform.

## Latest openmage/magento-lts (Packagist) vulnerabilities

- [CVE-2026-42458: OpenMage Magento LTS reflected XSS in Dataflow Profiles](https://junglewise.ai/threats/cve-2026-42458-openmage-magento-lts-reflected-xss-in-dataflow-profiles) (medium, CVSS 4, published 15 May 2026)
- [CVE-2026-42207: OpenMage Magento LTS open redirect in stockAction controller](https://junglewise.ai/threats/cve-2026-42207-openmage-magento-lts-open-redirect-in-stockaction-controller) (medium, CVSS 6.1, published 15 May 2026)
- [CVE-2026-42155: OpenMage Magento LTS predictable API session ID generation](https://junglewise.ai/threats/cve-2026-42155-openmage-magento-lts-predictable-api-session-id-generation) (critical, CVSS 4, published 15 May 2026)
- [CVE-2026-40488: OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution](https://junglewise.ai/threats/cve-2026-40488-openmage-lts-customer-file-upload-extension-blocklist-bypass) (high, CVSS 8.8, published 20 Apr 2026)
- [CVE-2026-40098: OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure](https://junglewise.ai/threats/cve-2026-40098-openmage-lts-cross-user-wishlist-import-leads-to-private-option) (medium, CVSS 5.4, published 20 Apr 2026)
- [CVE-2026-25525: OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module](https://junglewise.ai/threats/cve-2026-25525-openmage-lts-has-a-path-traversal-filter-bypass-in-dataflow) (medium, CVSS 4.9, published 20 Apr 2026)
- [CVE-2026-25524: OpenMage LTS: Phar Deserialization leads to Remote Code Execution](https://junglewise.ai/threats/cve-2026-25524-openmage-lts-phar-deserialization-leads-to-remote-code-execution) (high, CVSS 8.1, published 20 Apr 2026)
- [CVE-2026-25523: Magento's X-Original-Url header can expose admin url](https://junglewise.ai/threats/cve-2026-25523-magento-s-x-original-url-header-can-expose-admin-url) (low, CVSS 3.1, published 2 Feb 2026)
- [CVE-2025-64174: OpenMage vulnerable to XSS in Admin Notifications](https://junglewise.ai/threats/cve-2025-64174-openmage-vulnerable-to-xss-in-admin-notifications) (medium, CVSS 4, published 3 Nov 2025)
- [CVE-2025-27400: Magento LTS vulnerable to stored XSS in theme config fields](https://junglewise.ai/threats/cve-2025-27400-magento-lts-vulnerable-to-stored-xss-in-theme-config-fields) (low, CVSS 3.1, published 3 Mar 2025)
- [CVE-2024-41676: Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs](https://junglewise.ai/threats/cve-2024-41676-magento-lts-vulnerable-to-stored-cross-site-scripting-xss-in) (low, CVSS 3.1, published 29 Jul 2024)
- [Magento LTS vulnerable to stored XSS in admin file form](https://junglewise.ai/threats/magento-lts-vulnerable-to-stored-xss-in-admin-file-form-832e360c) (low, CVSS 3.1, published 27 Feb 2024)
- [Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor](https://junglewise.ai/threats/magento-lts-vulnerable-to-stored-xss-via-tinymce-wysiwyg-editor-d740b1dc) (low, CVSS 3.1, published 8 Dec 2023)
- [CVE-2023-41879: Magento LTS's guest order "protect code" can be brute-forced too easily](https://junglewise.ai/threats/cve-2023-41879-magento-lts-s-guest-order-protect-code-can-be-brute-forced-too) (low, CVSS 3.1, published 11 Sep 2023)
- [CVE-2021-41231: DataFlow upload remote code execution vulnerability](https://junglewise.ai/threats/cve-2021-41231-dataflow-upload-remote-code-execution-vulnerability) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2021-41144: Fix for authenticated remote code execution through layout update](https://junglewise.ai/threats/cve-2021-41144-fix-for-authenticated-remote-code-execution-through-layout-update) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2023-23617: DoS vulnerability in MaliciousCode filter](https://junglewise.ai/threats/cve-2023-23617-dos-vulnerability-in-maliciouscode-filter) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2021-41143: Fix for arbitrary file deletion in customer media allows for remote code execution](https://junglewise.ai/threats/cve-2021-41143-fix-for-arbitrary-file-deletion-in-customer-media-allows-for) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2021-39217: Fix for arbitrary command execution in custom layout update through blocks](https://junglewise.ai/threats/cve-2021-39217-fix-for-arbitrary-command-execution-in-custom-layout-update) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2021-21395: magento-lts Reset Password not protected against well-timed CSRF](https://junglewise.ai/threats/cve-2021-21395-magento-lts-reset-password-not-protected-against-well-timed-csrf) (low, CVSS 3.1, published 26 Jan 2023)
- [CVE-2021-32758: Layout XML Arbitrary Code Fix](https://junglewise.ai/threats/cve-2021-32758-layout-xml-arbitrary-code-fix) (info, published 30 Aug 2021)
- [CVE-2021-32759: Data Flow Sanitation Issue Fix](https://junglewise.ai/threats/cve-2021-32759-data-flow-sanitation-issue-fix) (info, published 30 Aug 2021)
- [CVE-2021-21427: Backport for Blind SQLi from Magento 2](https://junglewise.ai/threats/cve-2021-21427-backport-for-blind-sqli-from-magento-2) (low, CVSS 3.1, published 22 Apr 2021)
- [CVE-2021-21426: Fixes a bug in Zend Framework's Stream HTTP Wrapper](https://junglewise.ai/threats/cve-2021-21426-fixes-a-bug-in-zend-framework-s-stream-http-wrapper) (low, CVSS 3.1, published 22 Apr 2021)
- [CVE-2020-15244: RCE via PHP Object injection via SOAP Requests](https://junglewise.ai/threats/cve-2020-15244-rce-via-php-object-injection-via-soap-requests) (low, CVSS 3.1, published 30 Oct 2020)

## Most severe openmage/magento-lts (Packagist) vulnerabilities

- [CVE-2026-42155: OpenMage Magento LTS predictable API session ID generation](https://junglewise.ai/threats/cve-2026-42155-openmage-magento-lts-predictable-api-session-id-generation) (critical, CVSS 4, published 15 May 2026)
- [CVE-2026-40488: OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution](https://junglewise.ai/threats/cve-2026-40488-openmage-lts-customer-file-upload-extension-blocklist-bypass) (high, CVSS 8.8, published 20 Apr 2026)
- [CVE-2026-25524: OpenMage LTS: Phar Deserialization leads to Remote Code Execution](https://junglewise.ai/threats/cve-2026-25524-openmage-lts-phar-deserialization-leads-to-remote-code-execution) (high, CVSS 8.1, published 20 Apr 2026)
- [CVE-2026-42207: OpenMage Magento LTS open redirect in stockAction controller](https://junglewise.ai/threats/cve-2026-42207-openmage-magento-lts-open-redirect-in-stockaction-controller) (medium, CVSS 6.1, published 15 May 2026)
- [CVE-2026-40098: OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure](https://junglewise.ai/threats/cve-2026-40098-openmage-lts-cross-user-wishlist-import-leads-to-private-option) (medium, CVSS 5.4, published 20 Apr 2026)
- [CVE-2026-25525: OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module](https://junglewise.ai/threats/cve-2026-25525-openmage-lts-has-a-path-traversal-filter-bypass-in-dataflow) (medium, CVSS 4.9, published 20 Apr 2026)
- [CVE-2026-42458: OpenMage Magento LTS reflected XSS in Dataflow Profiles](https://junglewise.ai/threats/cve-2026-42458-openmage-magento-lts-reflected-xss-in-dataflow-profiles) (medium, CVSS 4, published 15 May 2026)
- [CVE-2025-64174: OpenMage vulnerable to XSS in Admin Notifications](https://junglewise.ai/threats/cve-2025-64174-openmage-vulnerable-to-xss-in-admin-notifications) (medium, CVSS 4, published 3 Nov 2025)
- [CVE-2021-39217: Fix for arbitrary command execution in custom layout update through blocks](https://junglewise.ai/threats/cve-2021-39217-fix-for-arbitrary-command-execution-in-custom-layout-update) (low, CVSS 3.1, published 27 Jan 2023)
- [CVE-2021-41143: Fix for arbitrary file deletion in customer media allows for remote code execution](https://junglewise.ai/threats/cve-2021-41143-fix-for-arbitrary-file-deletion-in-customer-media-allows-for) (low, CVSS 3.1, published 27 Jan 2023)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Packagist technologies

- [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities
- [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities
- [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities
- [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities
- [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities
- [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities
- [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities
- [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities
- [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities
- [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities
- [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities
- [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "openmage/magento-lts (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/openmage-magento-lts, 9 November 2026.