UM
Product
Umbraco-CMS
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 5High 9Medium 43Low 2
Watch
Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27601 | 4.3 | Mar 11 | Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality Affected: >= 15.0.0-rc1, < 15.2.3; < 14.3.3 |
| CVE-2024-10761 | 4.3 | Nov 4 | Umbraco CMS Dashboard frame cross site scripting Affected: 12.3.6 |
| CVE-2024-43377 | 4.3 | Aug 20 | Umbraco CMS Improper Access Control vulnerability Affected: >= 14.0.0, < 14.1.2 |
| CVE-2023-48227 | 4.3 | Dec 12 | Umbraco CMS Backoffice User can bypass "Publish" restriction Affected: >= 8.0.0, < 8.18.10; >= 9.0.0-rc001, < 10.7.0; >= 11.0.0-rc1, < 12.3.0 |
| CVE-2020-29454 | 4.3 | Dec 2 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access Affected: 8.0.0 through 8.9.1 |
| CVE-2020-7210 | 4.3 | Jan 23 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts Affected: 8.2.2 |
| CVE-2024-48929 | 4.2 | Oct 22 | Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out Affected: >= 13.0.0, < 13.5.2; >= 10.0.0, < 10.8.7 |
| CVE-2026-111624 | 3.7 | Oct 16 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs Affected: 17.0.0 before 17.7.1; 18.0.0 before 18.2.1 |
| CVE-2024-48926 | 3.1 | Oct 22 | Umbraco CMS logout page displayed before session expiration Affected: >= 13.0.0, < 13.5.2; >= 10.0.0, < 10.8.7; >= 8.0.0, < 8.18.15 |
| CVE-2013-4793 | – | Dec 27 | The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows… Affected: through 6.0.3 |