CVE-2026-128042 low vulnerability summary
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and...
CVE-2026-128042 is a Low severity vulnerability notice that security teams should triage for exposure in their own environments.
What to review
The affected area appears to involve OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage. Administrators should compare this notice against their asset inventory, dependency list, and externally exposed services.
Recommended action
Confirm whether the affected product or library is present, review vendor guidance, prioritize patching based on internet exposure and severity, and monitor logs for suspicious behavior tied to the affected component.
This brief is based on information from Tenable Newest CVEs . Please refer to the original source for the complete advisory and vendor-specific guidance.
Related Posts
CVE-2026-127093 medium vulnerability summary
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/i...
CVE-2026-128019 medium vulnerability summary
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env dire...
CVE-2026-128021 low vulnerability summary
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers s...