# Adobe Commerce


- [CVE-2026-75650](https://insights.sbomify.com/CVE-2026-75650/): Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine (critical 10.0, exploited in the wild)
- [CVE-2024-34102](https://insights.sbomify.com/CVE-2024-34102/): Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) (critical 9.8, exploited in the wild)
- [CVE-2022-24086](https://insights.sbomify.com/CVE-2022-24086/): Adobe Commerce and Magento Open Source Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2026-48356](https://insights.sbomify.com/CVE-2026-48356/): Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type (critical 9.3, exploited in the wild)
- [CVE-2026-71362](https://insights.sbomify.com/CVE-2026-71362/): Adobe Commerce and Magento Incorrect Authorization Vulnerability (critical 9.1, exploited in the wild)
- [CVE-2025-54236](https://insights.sbomify.com/CVE-2025-54236/): Adobe Commerce and Magento Improper Input Validation (critical 9.1, exploited in the wild)
- [CVE-2022-35698](https://insights.sbomify.com/CVE-2022-35698/): Adobe Commerce Stored XSS Arbitrary code execution (critical 10.0)
- [CVE-2024-45115](https://insights.sbomify.com/CVE-2024-45115/): Adobe Commerce | Improper Authentication (CWE-287) (critical 9.8)
- [CVE-2026-76200](https://insights.sbomify.com/CVE-2026-76200/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-76201](https://insights.sbomify.com/CVE-2026-76201/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-48358](https://insights.sbomify.com/CVE-2026-48358/): Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) (critical 9.1)
- [CVE-2025-24434](https://insights.sbomify.com/CVE-2025-24434/): Adobe Commerce | Incorrect Authorization (CWE-863) (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/adobe/commerce/