UM
Product
Umbraco-CMS
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 5High 9Medium 43Low 2
Watch
Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-32017 | 8.8 | Apr 8 | Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users Affected: >= 14.0.0--preview004, < 14.3.4; >= 15.0.0-rc1, < 15.3.1 |
| CVE-2020-9471 | 8.8 | Mar 16 | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality Affected: 8.5.3 |
| CVE-2026-69197 | 8.7 | Sep 17 | Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion Affected: >= 12.0.0, < 13.15.1; >= 14.0.0-rc1, < 17.5.3; >= 18.0.0, < 18.0.2 |
| CVE-2024-47819 | 8.7 | Oct 22 | Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section Affected: >= 14.0.0, < 14.3.1 |
| CVE-2026-117553 New | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning Affected: before 17.7.2; 18.0.0 before 18.2.2 |
| CVE-2022-22690 | 7.5 | Jan 18 | Umbraco Remote ApplicationURL Overwrite Affected: before 9.2.0 |
| CVE-2022-22691 | 7.4 | Jan 18 | Umbraco Password Reset URL Poison Affected: before 9.2.0 |
| CVE-2026-31834 | 7.2 | Mar 10 | Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks Affected: >= 15.3.1, < 16.5.1; >= 17.0.0, < 17.2.1 |
| CVE-2019-25137 | 7.2 | May 18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to… Affected: 4.11.8 through 7.15.10 |
Showing 9