Skip to contentUmbraco Umbraco-cms vulnerabilities
- umbraco umbraco-cmsUmbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header PoisoningCVE-2026-1175537.7 High
- umbraco umbraco-cmsUmbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR HubsCVE-2026-1116246.3 Medium
- umbraco umbraco-cmsUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionCVE-2026-69197Fix available8.7 High
- umbraco cms, umbraco-cms +1 moreUmbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogCVE-2026-46609Fix available4.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco.Cms: Open Redirect Vulnerability in Surface ControllersCVE-2026-46616Fix available5.4 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksCVE-2026-31834Fix available7.2 High
- umbraco cms, umbraco-cms +1 moreUmbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringCVE-2026-31833Fix available6.7 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Backoffice API Allows Unauthorized Modification of Domain DataCVE-2026-31832Fix available5.4 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityCVE-2025-66625Fix available4.9 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco's Delivery API allows for cached requests to be returned with an invalid API keyCVE-2025-54425Fix available5.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco.Cms Vulnerable to Disclosure of Configured Password RequirementsCVE-2025-49147Fix available5.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco Vulnerable to By-Pass of Configured Allowed Extensions for File UploadsCVE-2025-48953Fix available5.5 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco Makes User Enumeration Feasible Based on Timing of Login ResponseCVE-2025-46736Fix available5.3 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersCVE-2025-32017Fix available8.8 High
- umbraco umbraco-cms, cms +1 moreUmbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized ContentCVE-2025-27602Fix available4.9 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco Allows Improper API Access Control to Low-Privilege Users to Data Type FunctionalityCVE-2025-27601Fix available4.3 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco Backoffice Components Have XSS/HTML Injection VulnerabilityCVE-2025-24012Fix available4.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesCVE-2025-24011Public exploitFix available5.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Has Incomplete Server Termination During Explicit Sign-OutCVE-2024-48929Fix available4.2 Medium
- umbraco umbraco-cms, cms +1 morePotential Code Execution Risk When Viewing SVG Files in Full Screen in BackofficeCVE-2024-48927Fix available4.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS logout page displayed before session expirationCVE-2024-48926Fix available4.2 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook APICVE-2024-48925Fix available0.0 None
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionCVE-2024-47819Fix available4.2 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Improper Access Control vulnerabilityCVE-2024-43377Fix available5.4 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2024-43376Fix available4.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview PaneCVE-2024-35218Fix available4.2 Medium
- umbraco cms, umbraco-cms +1 moreOpen Redirect Bypass ProtectionCVE-2024-34071Fix available6.1 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco's Blind SSRF Leads to Port Scan by using WebhooksCVE-2024-29035Fix available4.1 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco possible user enumeration vulnerabilityCVE-2024-28868Fix available3.7 Low
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to stored XSS via SVG File UploadCVE-2023-49279Fix available3.7 Low
- umbraco cms, umbraco-cms +1 moreUmbraco CMS brute force exploit can be used to collect valid usernamesCVE-2023-49278Fix available5.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS SMTP misconfiguration exposes potential registered user emailCVE-2023-49274Fix available3.7 Low
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to Privilege Escalation using SpoofingCVE-2023-49273Fix available5.4 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS possible path traversal when creating packages from backofficeCVE-2023-49089Fix available7.7 High
- umbraco cms, umbraco-cms +1 moreUmbraco contains a DOM-XSSCVE-2023-48313Fix available4.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Backoffice User can bypass "Publish" restrictionCVE-2023-48227Fix available4.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to possible injection of HTML in an unintended formCVE-2023-38694Fix available3.5 Low
- umbraco cms, umbraco-cms +1 moreUmbraco allows possible Admin-level access to backoffice without Auth under rare conditionsCVE-2023-37267Fix available7.5 High