Login Request a demo
UM
Vendor
umbraco
11 products with CVEs on record
85
CVEs
0
On KEV
2
New 30D
Products
UM
Umbraco-CMS
umbraco
10.0
60 CVEs0 on KEV2 new
UF
Umbraco Forms
Umbraco
9.8
7 CVEs0 on KEV0 new
UM
Umbraco
umbraco
9.8
5 CVEs0 on KEV0 new
UM
Umbraco.Forms.Issues
umbraco
6.5
4 CVEs0 on KEV0 new
CM
CMS
Umbraco
9.8
2 CVEs0 on KEV0 new
FO
Forms
Umbraco
9.8
2 CVEs0 on KEV0 new
UM
Umbraco.Commerce.Issues
umbraco
5.4
1 CVEs0 on KEV0 new
UM
Umbraco.Engage.Forms
umbraco
7.5
1 CVEs0 on KEV0 new
UI
Umbraco Identity Extensibility
Umbraco
5.3
1 CVEs0 on KEV0 new
UM
Umbraco.Workflow.Issues
umbraco
5.5
1 CVEs0 on KEV0 new
UM
UmbracoIdentityExtensions
umbraco
5.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-117553
New
UM
Umbraco-CMS
umbraco
7.5
0%
Oct 27Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
CVE-2026-111624
UM
Umbraco-CMS
umbraco
3.7
0%
Oct 16Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
CVE-2026-69197
UM
Umbraco-CMS
umbraco
8.7
1%
Sep 17Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
CVE-2026-46609
UM
Umbraco-CMS
umbraco
4.6
0%
Jun 10Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
CVE-2026-46616
UM
Umbraco-CMS
umbraco
6.1
0%
Jun 10Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
CVE-2026-31834
UM
Umbraco-CMS
umbraco
7.2
0%
Mar 10Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
CVE-2026-31833
UM
Umbraco-CMS
umbraco
6.7
0%
Mar 10Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
CVE-2026-31832
UM
Umbraco-CMS
umbraco
5.4
0%
Mar 10Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
CVE-2026-27449
UM
Umbraco.Engage.Forms
umbraco
7.5
0%
Feb 26Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
CVE-2026-24687
UM
Umbraco.Forms.Issues
umbraco
6.5
0%
Jan 29Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
CVE-2025-68924
FO
Forms
Umbraco
7.5
1%
Jan 16In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution
CVE-2021-47776
UM
Umbraco
umbraco
5.3
0%
Jan 15Umbraco v8.14.1 - 'baseUrl' SSRF
CVE-2025-67288
UC
Umbraco Cms
Umbraco
10.0
1%
Dec 22An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file
CVE-2025-66625
UM
Umbraco-CMS
umbraco
4.9
0%
Dec 9Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
CVE-2012-10054
CM
CMS
Umbraco
9.8
4%
Aug 13Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
CVE-2025-54425
UM
Umbraco-CMS
umbraco
5.3
0%
Jul 30Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
CVE-2025-49147
UM
Umbraco-CMS
umbraco
5.3
0%
Jun 24Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
CVE-2025-48953
UM
Umbraco-CMS
umbraco
6.5
0%
Jun 3Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
CVE-2025-47280
UM
Umbraco.Forms.Issues
umbraco
6.1
0%
May 13Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
CVE-2025-46736
UM
Umbraco-CMS
umbraco
5.3
0%
May 6Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
CVE-2025-32017
UM
Umbraco-CMS
umbraco
8.8
1%
Apr 8Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
CVE-2025-27602
UM
Umbraco-CMS
umbraco
6.4
0%
Mar 11Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
CVE-2025-27601
UM
Umbraco-CMS
umbraco
4.3
0%
Mar 11Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
CVE-2024-55488
UC
Umbraco Cms
Umbraco
6.5
0%
Jan 22A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
CVE-2025-24012
UM
Umbraco-CMS
umbraco
5.4
0%
Jan 21Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability
CVE-2025-24011
UM
Umbraco-CMS
umbraco
5.3
2%
Jan 21Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
CVE-2025-23041
UM
Umbraco.Forms.Issues
umbraco
5.3
0%
Jan 14Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
CVE-2024-10761
CM
CMS
Umbraco
4.3
1%
Nov 4Umbraco CMS Dashboard frame cross site scripting
CVE-2024-48929
UM
Umbraco-CMS
umbraco
4.2
0%
Oct 22Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
CVE-2024-48927
UM
Umbraco-CMS
umbraco
4.6
0%
Oct 22Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
CVE-2024-48926
UM
Umbraco-CMS
umbraco
3.1
0%
Oct 22Umbraco CMS logout page displayed before session expiration
CVE-2024-48925
UM
Umbraco-CMS
umbraco
6.5
0%
Oct 22Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
CVE-2024-47819
UM
Umbraco-CMS
umbraco
8.7
0%
Oct 22Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
CVE-2024-43377
UM
Umbraco-CMS
umbraco
4.3
0%
Aug 20Umbraco CMS Improper Access Control vulnerability
CVE-2024-43376
UM
Umbraco-CMS
umbraco
5.3
0%
Aug 20Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
CVE-2024-35240
UM
Umbraco.Commerce.Issues
umbraco
5.4
0%
May 28Stored Cross-site Scripting on Print Functionality in Umbraco Commerce
CVE-2024-35239
UM
Umbraco.Forms.Issues
umbraco
5.4
0%
May 28Stored Cross-site Scripting on Components of Umbraco Forms
CVE-2024-35218
UM
Umbraco-CMS
umbraco
4.8
0%
May 21Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
CVE-2024-34071
UM
Umbraco-CMS
umbraco
6.1
0%
May 21Open Redirect Bypass Protection
CVE-2024-32872
UM
Umbraco.Workflow.Issues
umbraco
5.5
0%
Apr 24Umbraco Workflow's Backoffice users can execute arbitrary SQL
CVE-2024-29035
UM
Umbraco-CMS
umbraco
5.3
0%
Apr 17Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
CVE-2024-28868
UM
Umbraco-CMS
umbraco
5.3
0%
Mar 20Umbraco possible user enumeration vulnerability
CVE-2023-49279
UM
Umbraco-CMS
umbraco
5.4
0%
Dec 12Umbraco CMS vulnerable to stored XSS via SVG File Upload
CVE-2023-49278
UM
Umbraco-CMS
umbraco
5.3
0%
Dec 12Umbraco CMS brute force exploit can be used to collect valid usernames
CVE-2023-49274
UM
Umbraco-CMS
umbraco
5.3
0%
Dec 12Umbraco CMS SMTP misconfiguration exposes potential registered user email
CVE-2023-49273
UM
Umbraco-CMS
umbraco
5.4
0%
Dec 12Umbraco CMS vulnerable to Privilege Escalation using Spoofing
CVE-2023-49089
UM
Umbraco-CMS
umbraco
6.5
1%
Dec 12Umbraco CMS possible path traversal when creating packages from backoffice
CVE-2023-48313
UM
Umbraco-CMS
umbraco
6.1
0%
Dec 12Umbraco contains a DOM-XSS
CVE-2023-48227
UM
Umbraco-CMS
umbraco
4.3
0%
Dec 12Umbraco CMS Backoffice User can bypass "Publish" restriction
CVE-2023-38694
UM
Umbraco-CMS
umbraco
5.4
0%
Dec 12Umbraco CMS vulnerable to possible injection of HTML in an unintended form
CVE-2023-37267
UM
Umbraco-CMS
umbraco
9.8
1%
Jul 13Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
CVE-2023-32312
UM
UmbracoIdentityExtensions
umbraco
5.3
1%
Jun 9Client secret not mandatory in UmbracoIdentityExtensions
CVE-2019-25137
UC
Umbraco Cms
Umbraco
7.2
4%
May 18Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to…
CVE-2021-33224
UF
Umbraco Forms
Umbraco
9.8
1%
Feb 24File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file
CVE-2022-22690
UC
Umbraco CMS
Umbraco
7.5
1%
Jan 18Umbraco Remote ApplicationURL Overwrite
CVE-2022-22691
UC
Umbraco CMS
Umbraco
7.4
1%
Jan 18Umbraco Password Reset URL Poison
CVE-2021-37334
FO
Forms
Umbraco
9.8
3%
Aug 25Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion
CVE-2021-34254
UC
Umbraco Cms
Umbraco
6.1
1%
Jun 28Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx
CVE-2020-5809
UC
Umbraco Cms
Umbraco
5.4
1%
Dec 30A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current
CVE-2020-5810
UC
Umbraco Cms
Umbraco
5.4
62%
Dec 30A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current