https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:36:06.390926+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42207 CVE-2026-42207 — Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts 2026-10-07T20:36:06.411028+00:00

Affected: OpenMage magento-lts

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.