UM
Product
Umbraco-CMS
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 5High 9Medium 43Low 2
Watch
Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27601 | 4.3 | Mar 11 | Umbraco is a free and open source .NET content management system Affected: before 14.3.3; 15.0.0 before 15.2.3 |
| CVE-2024-10761 | 4.3 | Nov 4 | A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1 Affected: 12.3.6 |
| CVE-2024-43377 | 4.3 | Aug 20 | Umbraco CMS is an ASP.NET CMS Affected: 14.0.0 before 14.1.2 |
| CVE-2023-48227 | 4.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) Affected: 8.0.0 before 8.18.10; 9.0.0 before 10.7.0; 11.0.0 before 12.3.0 |
| CVE-2020-29454 | 4.3 | Dec 2 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access Affected: 8.0.0 through 8.9.1 |
| CVE-2020-7210 | 4.3 | Jan 23 | Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts Affected: 8.2.2 |
| CVE-2024-48929 | 4.2 | Oct 22 | Umbraco is a free and open source .NET content management system Affected: 10.0 before 10.8.7; 13.0 before 13.5.2 |
| CVE-2026-111624 | 3.7 | Oct 16 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs Affected: 17.0.0 before 17.7.1; 18.0.0 before 18.2.1 |
| CVE-2024-48926 | 3.1 | Oct 22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7,… Affected: 8.0 before 8.18.15; 10.0 before 10.8.7; 13.0 before 13.5.2 |
| CVE-2013-4793 | – | Dec 27 | The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows… Affected: through 6.0.3 |