Umbraco Umbraco CMS

• CVE-2026-117553 High 7.5 Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning 0.5%
• CVE-2026-111624 Low 3.7 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs 0.3%
• CVE-2026-69197 High 8.7 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion 0.7%
• CVE-2026-46609 Medium 4.6 Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog 0.1%
• CVE-2026-46616 Medium 5.4 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers 0.2%
• CVE-2026-31834 High 7.2 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks 0.4%
• CVE-2026-31833 Medium 6.7 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering 0.3%
• CVE-2026-31832 Medium 5.4 Umbraco Backoffice API Allows Unauthorized Modification of Domain Data 0.2%
• CVE-2025-66625 Medium 4.9 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality 0.4%
• CVE-2025-54425 Medium 5.3 Umbraco's Delivery API allows for cached requests to be returned with an invalid API key 0.4%
• CVE-2025-49147 Medium 5.3 Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements 0.3%
• CVE-2025-48953 Medium 5.5 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads 0.2%
• CVE-2025-46736 Medium 5.3 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response 0.4%
• CVE-2025-32017 High 8.8 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users 0.6%
• CVE-2025-27602 Medium 4.9 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content 0.3%
• CVE-2025-27601 Medium 4.3 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality 0.3%
• CVE-2025-24012 Medium 4.6 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability 0.3%
• CVE-2025-24011 Medium 5.3 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes 1.6%
• CVE-2024-48929 Medium 4.2 Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out 0.3%
• CVE-2024-48927 Medium 4.6 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice 0.5%
• CVE-2024-48926 Medium 4.2 Umbraco CMS logout page displayed before session expiration 0.3%
• CVE-2024-48925 None 0.0 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API 0.4%
• CVE-2024-47819 Medium 4.2 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section 0.4%
• CVE-2024-43377 Medium 5.4 Umbraco CMS Improper Access Control vulnerability 0.2%
• CVE-2024-43376 Medium 4.3 Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information 0.4%
• CVE-2024-35218 Medium 4.2 Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane 0.4%
• CVE-2024-34071 Medium 6.1 Open Redirect Bypass Protection 0.4%
• CVE-2024-29035 Medium 4.1 Umbraco's Blind SSRF Leads to Port Scan by using Webhooks 0.4%
• CVE-2024-28868 Low 3.7 Umbraco possible user enumeration vulnerability 0.5%
• CVE-2023-49279 Low 3.7 Umbraco CMS vulnerable to stored XSS via SVG File Upload 0.4%
• CVE-2023-49278 Medium 5.3 Umbraco CMS brute force exploit can be used to collect valid usernames 0.5%
• CVE-2023-49274 Low 3.7 Umbraco CMS SMTP misconfiguration exposes potential registered user email 0.5%
• CVE-2023-49273 Medium 5.4 Umbraco CMS vulnerable to Privilege Escalation using Spoofing 0.4%
• CVE-2023-49089 High 7.7 Umbraco CMS possible path traversal when creating packages from backoffice 0.6%
• CVE-2023-48313 Medium 4.3 Umbraco contains a DOM-XSS 0.4%
• CVE-2023-48227 Medium 4.3 Umbraco CMS Backoffice User can bypass "Publish" restriction 0.4%
• CVE-2023-38694 Low 3.5 Umbraco CMS vulnerable to possible injection of HTML in an unintended form 0.4%
• CVE-2023-37267 High 7.5 Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions 0.7%
• CVE-2022-22690 High 8.6 Umbraco Remote ApplicationURL Overwrite 1.1%
• CVE-2022-22691 Medium 6.8 Umbraco Password Reset URL Poison 1.0%