Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

Magento Path Traversal vulnerability

Magento Improper input validation vulnerability

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.

Magento Improper Authorization vulnerability in the customers module

Magento Information Disclosure vulnerability

Magento Unauthorized access to restricted resources

Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies