{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "magento",
    "label": "Magento",
    "isStack": false,
    "url": "https://pwn.watch/t/magento",
    "feed": "https://pwn.watch/t/magento/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "adobe-commerce-and-magento-cve-2026-71362",
      "title": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento ",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-71362"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-24",
      "closedAt": "2026-09-24",
      "updatedAt": "2026-09-24",
      "summary": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2026-75650",
      "title": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-75650"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-08",
      "closedAt": "2026-09-08",
      "updatedAt": "2026-09-08",
      "summary": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Added to CISA KEV on 2026-09-08.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2025-54236",
      "title": "Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-54236"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-24",
      "closedAt": "2025-10-24",
      "updatedAt": "2025-10-24",
      "summary": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. Added to CISA KEV on 2025-10-24.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "title": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento Open Source",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-34102"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-13",
      "closedAt": "2024-07-17",
      "updatedAt": "2024-07-17",
      "summary": "Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-07-17.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "adobe-commerce-and-magento-cve-2026-71362",
      "incidentTitle": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-24",
      "title": "CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2026-75650",
      "incidentTitle": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-08",
      "title": "CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2025-54236",
      "incidentTitle": "Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-24",
      "title": "CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236"
    },
    {
      "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-17",
      "title": "CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102"
    },
    {
      "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CVE-2024-34102 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-34102",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102"
    }
  ]
}