Umbraco vulnerabilities

Products

• Cms 57
• Umbraco-cms 38
• Forms 7
• Umbraco 5
• Cms 5
• Umbraco.forms.issues 4
• Cms 2
• Forms 2

Newest

• umbraco umbraco-cms Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning CVE-2026-117553 7.7 HighOctober 27, 2026
• umbraco umbraco-cms Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs CVE-2026-111624 6.3 MediumOctober 16, 2026
• umbraco umbraco-cms Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion CVE-2026-69197 Fix available 8.7 HighSeptember 17, 2026
• umbraco cms, umbraco-cms +1 more Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog CVE-2026-46609 Fix available 4.6 MediumMay 21, 2026
• umbraco cms, umbraco-cms +1 more Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers CVE-2026-46616 Fix available 5.4 MediumMay 21, 2026
• umbraco cms, umbraco-cms +1 more Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks CVE-2026-31834 Fix available 7.2 HighMarch 10, 2026
• umbraco cms, umbraco-cms +1 more Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering CVE-2026-31833 Fix available 6.7 MediumMarch 10, 2026
• umbraco cms, umbraco-cms +1 more Umbraco Backoffice API Allows Unauthorized Modification of Domain Data CVE-2026-31832 Fix available 5.4 MediumMarch 10, 2026
• umbraco umbraco.engage.forms Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints CVE-2026-27449 Fix available 7.5 HighFebruary 26, 2026
• umbraco forms, umbraco.forms.issues +1 more Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac CVE-2026-24687 Fix available 6.0 MediumJanuary 29, 2026
• umbraco, umbraco cms +1 more Umbraco v8.14.1 - 'baseUrl' SSRF CVE-2021-47776 6.9 MediumJanuary 15, 2026
• made i.t. forms UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation CVE-2025-68924 7.5 HighJanuary 13, 2026
• umbraco cms Umbraco CMS has an arbitrary file upload vulnerability CVE-2025-67288 10.0 CriticalDecember 22, 2025
• umbraco cms, umbraco-cms +1 more Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality CVE-2025-66625 Fix available 4.9 MediumDecember 9, 2025
• statamic cms Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVE-2012-10054 Public exploit 9.3 CriticalAugust 13, 2025
• umbraco cms, umbraco-cms +1 more Umbraco's Delivery API allows for cached requests to be returned with an invalid API key CVE-2025-54425 Fix available 5.3 MediumJuly 29, 2025
• umbraco cms, umbraco-cms +1 more Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements CVE-2025-49147 Fix available 5.3 MediumJune 24, 2025
• umbraco cms, umbraco-cms +1 more Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads CVE-2025-48953 Fix available 5.5 MediumJune 3, 2025
• umbraco forms, umbraco.forms.issues +1 more Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow CVE-2025-47280 Fix available 2.3 LowMay 13, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Makes User Enumeration Feasible Based on Timing of Login Response CVE-2025-46736 Fix available 5.3 MediumMay 6, 2025
• umbraco umbraco-cms, cms +1 more Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users CVE-2025-32017 Fix available 8.8 HighApril 8, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content CVE-2025-27602 Fix available 4.9 MediumMarch 11, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality CVE-2025-27601 Fix available 4.3 MediumMarch 11, 2025
• umbraco cms Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting CVE-2024-55488 Disputed 6.5 MediumJanuary 22, 2025
• umbraco umbraco-cms, cms +1 more Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability CVE-2025-24012 Fix available 4.6 MediumJanuary 21, 2025
• umbraco cms, umbraco-cms +1 more Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes CVE-2025-24011 Public exploitFix available 5.3 MediumJanuary 21, 2025
• umbraco forms, umbraco.forms.issues +1 more Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms CVE-2025-23041 Fix available 5.8 MediumJanuary 14, 2025
• statamic cms Umbraco CMS Dashboard frame cross site scripting CVE-2024-10761 Fix available 6.9 MediumNovember 4, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out CVE-2024-48929 Fix available 4.2 MediumOctober 22, 2024
• umbraco umbraco-cms, cms +1 more Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice CVE-2024-48927 Fix available 4.6 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS logout page displayed before session expiration CVE-2024-48926 Fix available 4.2 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API CVE-2024-48925 Fix available 0.0 NoneOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section CVE-2024-47819 Fix available 4.2 MediumOctober 22, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Improper Access Control vulnerability CVE-2024-43377 Fix available 5.4 MediumAugust 20, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information CVE-2024-43376 Fix available 4.3 MediumAugust 20, 2024
• umbraco umbraco.commerce.issues Stored Cross-site Scripting on Print Functionality in Umbraco Commerce CVE-2024-35240 Fix available 5.4 MediumMay 28, 2024
• umbraco forms, umbraco.forms.issues +1 more Stored Cross-site Scripting on Components of Umbraco Forms CVE-2024-35239 Fix available 2.7 LowMay 28, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane CVE-2024-35218 Fix available 4.2 MediumMay 21, 2024
• umbraco cms, umbraco-cms +1 more Open Redirect Bypass Protection CVE-2024-34071 Fix available 6.1 MediumMay 21, 2024
• umbraco umbraco.workflow.issues Umbraco Workflow's Backoffice users can execute arbitrary SQL CVE-2024-32872 Fix available 5.5 MediumApril 24, 2024
• umbraco cms, umbraco-cms +1 more Umbraco's Blind SSRF Leads to Port Scan by using Webhooks CVE-2024-29035 Fix available 4.1 MediumApril 17, 2024
• umbraco umbraco-cms, cms +1 more Umbraco possible user enumeration vulnerability CVE-2024-28868 Fix available 3.7 LowMarch 20, 2024
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to stored XSS via SVG File Upload CVE-2023-49279 Fix available 3.7 LowDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS brute force exploit can be used to collect valid usernames CVE-2023-49278 Fix available 5.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS SMTP misconfiguration exposes potential registered user email CVE-2023-49274 Fix available 3.7 LowDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to Privilege Escalation using Spoofing CVE-2023-49273 Fix available 5.4 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS possible path traversal when creating packages from backoffice CVE-2023-49089 Fix available 7.7 HighDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco contains a DOM-XSS CVE-2023-48313 Fix available 4.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS Backoffice User can bypass "Publish" restriction CVE-2023-48227 Fix available 4.3 MediumDecember 12, 2023
• umbraco cms, umbraco-cms +1 more Umbraco CMS vulnerable to possible injection of HTML in an unintended form CVE-2023-38694 Fix available 3.5 LowDecember 12, 2023
• Show olderLoading…