Login Request a demo
UM
Product
Umbraco-CMS
by umbraco · last CVE Oct 27, 2026
60
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Vulnerabilities60In the news0Timeline
Severity mix
Critical 5High 9Medium 43Low 2
Severity
All severities60Critical5High9Medium43Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Umbraco-CMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-32017
8.8
1%
Apr 8
Umbraco is a free and open source .NET content management system
Affected: 14.0.0 before 14.3.4; 15.0.0 before 15.3.1
CVE-2020-9471
8.8
2%
Mar 16
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality
Affected: 8.5.3
CVE-2026-69197
8.7
1%
Sep 17
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Affected: >= 12.0.0, < 13.15.1; >= 14.0.0-rc1, < 17.5.3; >= 18.0.0, < 18.0.2
CVE-2024-47819
8.7
0%
Oct 22
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0
Affected: 14.0.0 before 14.3.1
CVE-2026-117553
New
7.5–Oct 27
Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
Affected: before 17.7.2; 18.0.0 before 18.2.2
CVE-2022-22690
7.5
1%
Jan 18
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to…
Affected: before 9.2.0
CVE-2022-22691
7.4
1%
Jan 18
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL
Affected: before 9.2.0
CVE-2026-31834
7.2
0%
Mar 10
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
Affected: >= 15.3.1, < 16.5.1; >= 17.0.0, < 17.2.1
CVE-2019-25137
7.2
4%
May 18
Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to…
Affected: 4.11.8 through 7.15.10
Showing 9