https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T12:34:38.019076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-64591 cnvd-2020-64591 2026-10-18T12:34:38.339120+00:00 cnvd-2020-64591 https://cve.radiocsirt.org/vuln/euvd-2026-42789 EUVD-2026-42789 2026-10-18T12:34:38.339159+00:00 EUVD-2026-42789 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15244 fkie_cve-2020-15244 2026-10-18T12:34:38.339174+00:00

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

 https://cve.radiocsirt.org/vuln/ghsa-jrgf-vfw2-hj26 GHSA-jrgf-vfw2-hj26 — RCE via PHP Object injection via SOAP Requests 2026-10-18T12:34:38.339203+00:00

Affected: Packagist: openmage/magento-lts

### Impact This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

### Patches The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

### Credits Credit to Luke Rodgers for reporting

 https://cve.radiocsirt.org/vuln/gsd-2020-15244 gsd-2020-15244 2026-10-18T12:34:38.339230+00:00 gsd-2020-15244