Umbraco

Products

Exploited and recent CVEs

• CVE-2026-117553 High 7.5 Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning 0.5%
• CVE-2026-111624 Low 3.7 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs 0.3%
• CVE-2026-69197 High 8.7 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion 0.7%
• CVE-2026-46609 Medium 4.6 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog 0.1%
• CVE-2026-46616 Medium 5.4 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers 0.2%
• CVE-2026-31834 High 7.2 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks 0.4%
• CVE-2026-31833 Medium 6.7 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering 0.3%
• CVE-2026-31832 Medium 5.4 Umbraco Backoffice API Allows Unauthorized Modification of Domain Data 0.2%
• CVE-2026-27449 High 7.5 Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints 0.4%
• CVE-2026-24687 Medium 6.0 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac 0.5%
• CVE-2025-68924 High 7.5 In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution. 0.8%
• CVE-2021-47776 Medium 5.3 Umbraco v8.14.1 - 'baseUrl' SSRF 0.4%
• CVE-2025-66625 Medium 4.9 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality 0.4%
• CVE-2025-54425 Medium 5.3 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key 0.4%
• CVE-2025-49147 Medium 5.3 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements 0.3%
• CVE-2025-48953 Medium 5.5 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads 0.2%
• CVE-2025-47280 Low 2.3 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow 0.3%
• CVE-2025-46736 Medium 5.3 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response 0.4%
• CVE-2025-32017 High 8.8 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users 0.6%
• CVE-2025-27602 Medium 4.9 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content 0.3%
• CVE-2025-27601 Medium 4.3 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality 0.3%
• CVE-2025-24012 Medium 4.6 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability 0.3%
• CVE-2025-24011 Medium 5.3 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes 1.6%
• CVE-2025-23041 Medium 5.8 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms 0.4%
• CVE-2024-10761 Medium 4.3 Umbraco CMS Dashboard frame cross site scripting 0.6%
• CVE-2024-48929 Medium 4.2 Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out 0.3%
• CVE-2024-48927 Medium 4.6 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice 0.5%
• CVE-2024-48926 Medium 4.2 Umbraco CMS logout page displayed before session expiration 0.3%
• CVE-2024-48925 None 0.0 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API 0.4%
• CVE-2024-47819 Medium 4.2 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section 0.4%