How many CVEs have a located fix in OpenMage/magento-lts?

16 published CVEs have a fix traced to functions in OpenMage/magento-lts, touching 28 functions across 23 files.

Which function in OpenMage/magento-lts has been patched by the most CVEs?

validateAgainstBlockMethodBlacklist in app/code/core/Mage/Core/Helper/Security.php has been changed by 2 CVE fixes, from 2021 to 2023.

How large is a typical CVE fix in OpenMage/magento-lts?

The median fix changes 8 lines. 69% of fixes change 20 lines or fewer, and 44% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#350 of 500 repositories

OpenMage/magento-lts

Name: OpenMage/magento-lts: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix November 6, 2025

16

CVE fixes located

Published CVEs

28

Functions patched

Distinct function sites

23

Files patched

Distinct source files

2020–2025

Years covered

By CVE publication date

Overview

16 published CVEs have a fix traced to functions in OpenMage/magento-lts, the earliest published in 2020. Those fixes changed 28 distinct functions across 23 files, in 66 patch hunks.

Among the 500 repositories tracked here, OpenMage/magento-lts ranks #350 by the number of CVEs with a located fix.

Most patched functions

Functions in OpenMage/magento-lts changed by the most CVE fixes.

Most patched files

Files in OpenMage/magento-lts changed by the most CVE fixes.

1app/code/core/Mage/Core/Helper/Security.php4 CVEs · 2 functions
2app/code/core/Mage/Core/Model/Layout.php2 CVEs · 3 functions
3app/code/core/Mage/Core/Block/Abstract.php2 CVEs · 2 functions
4app/code/core/Mage/Page/Block/Html/Header.php1 CVEs · 4 functions
5app/code/core/Mage/Core/Model/Design/Package.php1 CVEs · 2 functions
6app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php1 CVEs · 1 functions
7app/code/core/Mage/Adminhtml/Controller/Action.php1 CVEs · 1 functions
8app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php1 CVEs · 1 functions
9app/code/core/Mage/Catalog/Model/Product/Attribute/Backend/Media.php1 CVEs · 1 functions
10app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php1 CVEs · 1 functions

Fix size

How much code a CVE fix in OpenMage/magento-lts changes, with backports counted once.

8

Median lines changed

Added plus removed, per CVE

69%

Fixes of 20 lines or fewer

Share of CVE fixes

44%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in OpenMage/magento-lts, and the functions each fix changed.

OpenMage is vulnerable to XSS in Admin Notifications
CVE-2025-64174helper
Medium · CVSS 4.6
EPSS 0.2%2025-11-06
Magento vulnerable to stored XSS in theme config fields
CVE-2025-27400getSkinBaseUrl getSkinUrl
Low · CVSS 2.9
EPSS 0.3%2025-02-28
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
CVE-2024-41676Mage_Core_Model_Security_HtmlEscapedString getLogoAlt getLogoSrc
Medium · CVSS 5.1
EPSS 0.4%2024-07-29
Magento LTS's guest order "protect code" can be brute-forced too easily
CVE-2023-41879isRateLimitExceeded loadValidOrder _beforeSave
High · CVSS 7.5
EPSS 1.3%2023-09-11
DoS vulnerability in MaliciousCode filter
CVE-2023-23617Mage_Core_Model_Input_Filter_MaliciousCode
High · CVSS 7.5
EPSS 1.0%2023-01-27
DataFlow upload remote code execution vulnerability
CVE-2021-41231read addImage
High · CVSS 7.2
EPSS 1.2%2023-01-27
Fix for authenticated remote code execution through layout update
CVE-2021-41144Mage_Core_Helper_Security getChildGroup
High · CVSS 8.8
EPSS 1.2%2023-01-27
Fix for arbitrary file deletion in customer media allows for remote code execution
CVE-2021-41143deleteDirectory
High · CVSS 7.2
EPSS 1.3%2023-01-27
OpenMage LTS arbitrary command execution in custom layout update through blocks
CVE-2021-39217validateAgainstBlockMethodBlacklist
High · CVSS 7.2
EPSS 1.3%2023-01-27
Data Flow Sanitation Issue Fix
CVE-2021-32759getResource
High · CVSS 7.2
EPSS 1.3%2021-08-27
Layout XML Arbitrary Code Fix
CVE-2021-32758validateAgainstBlockMethodBlacklist
High · CVSS 7.2
EPSS 2.0%2021-08-27
CVE-2020-26295
CVE-2020-26295Mage_Core_Helper_Security _generateAction unsetCallChild
High · CVSS 8.7
EPSS 1.8%2021-01-21

Get an alert for each new OpenMage/magento-lts CVE, with the patched functions and AI-written analysis.

Monitor magento-lts CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Alinto/sogo16 CVEs android.googlesource.com/platform-system-bt16 CVEs argoproj/argo-workflows16 CVEs codeigniter4/CodeIgniter416 CVEs debian/libmatio16 CVEs debian/libvncserver16 CVEs debian/netatalk16 CVEs debian/nss16 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in OpenMage/magento-lts.

How many CVEs have a located fix in OpenMage/magento-lts?: 16 published CVEs have a fix traced to functions in OpenMage/magento-lts, touching 28 functions across 23 files.
Which function in OpenMage/magento-lts has been patched by the most CVEs?: validateAgainstBlockMethodBlacklist in app/code/core/Mage/Core/Helper/Security.php has been changed by 2 CVE fixes, from 2021 to 2023.
How large is a typical CVE fix in OpenMage/magento-lts?: The median fix changes 8 lines. 69% of fixes change 20 lines or fewer, and 44% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track OpenMage/magento-lts CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing