Login Request a demo
UM
Product
Umbraco-CMS
by umbraco · last CVE Oct 27, 2026
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Vulnerabilities60In the news0Timeline
Severity mix
Critical 5High 9Medium 43Low 2
Severity
All severities60Critical5High9Medium43Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-67288
10.0
1%
Dec 22
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file
Affected: 16.3.3
CVE-2012-10054
9.8
4%
Aug 13
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Affected: before 4.7.1
CVE-2023-37267
9.8
1%
Jul 13
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
Affected: >= 9.0.0, < 10.6.1; >= 11.0.0, < 11.4.2; = 12.0.0
CVE-2014-10074
9.8
3%
Aug 27
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files
Affected: before 7.2.0
CVE-2012-1301
9.8
3%
Apr 13
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter
Affected: 4.7.0
Showing 5