UM
Vendor
umbraco
77
CVEs
0
On KEV
2
New 30D
Products
UM10.0
Umbraco-CMS
umbraco
60 CVEs0 on KEV2 new
UF9.8
Umbraco Forms
Umbraco
7 CVEs0 on KEV0 new
UM9.8
Umbraco
umbraco
5 CVEs0 on KEV0 new
FO9.8
Forms
Umbraco
2 CVEs0 on KEV0 new
UM7.5
Umbraco.Engage.Forms
umbraco
1 CVEs0 on KEV0 new
UM6.5
Umbraco.Forms.Issues
umbraco
1 CVEs0 on KEV0 new
UI5.3
Umbraco Identity Extensibility
Umbraco
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117553 New | UM Umbraco-CMS umbraco | 7.5 | Oct 27 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning |
| CVE-2026-111624 | UM Umbraco-CMS umbraco | 3.7 | Oct 16 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs |
| CVE-2026-69197 | UM Umbraco-CMS umbraco | 8.7 | Sep 17 | Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion |
| CVE-2026-46609 | UM Umbraco-CMS umbraco | 4.6 | Jun 10 | Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog |
| CVE-2026-46616 | UM Umbraco-CMS umbraco | 6.1 | Jun 10 | Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers |
| CVE-2026-31834 | UM Umbraco-CMS umbraco | 7.2 | Mar 10 | Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks |
| CVE-2026-31833 | UM Umbraco-CMS umbraco | 6.7 | Mar 10 | Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering |
| CVE-2026-31832 | UM Umbraco-CMS umbraco | 5.4 | Mar 10 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
| CVE-2026-27449 | UM Umbraco.Engage.Forms umbraco | 7.5 | Feb 26 | Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints |
| CVE-2026-24687 | UM Umbraco.Forms.Issues umbraco | 6.5 | Jan 29 | Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac |
| CVE-2025-68924 | FO Forms Umbraco | 7.5 | Jan 16 | In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution |
| CVE-2021-47776 | UM Umbraco umbraco | 5.3 | Jan 15 | Umbraco v8.14.1 - 'baseUrl' SSRF |
| CVE-2025-67288 | UC Umbraco Cms Umbraco | 10.0 | Dec 22 | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file |
| CVE-2025-66625 | UM Umbraco-CMS umbraco | 4.9 | Dec 9 | Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality |
| CVE-2012-10054 | UC Umbraco Cms Umbraco | 9.8 | Aug 13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that… |
| CVE-2025-54425 | UC Umbraco Cms Umbraco | 5.3 | Jul 30 | Umbraco is an ASP.NET CMS |
| CVE-2025-49147 | UC Umbraco Cms Umbraco | 5.3 | Jun 24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1 |
| CVE-2025-48953 | UC Umbraco Cms Umbraco | 6.5 | Jun 3 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2025-47280 | UF Umbraco Forms Umbraco | 6.1 | May 13 | Umbraco Forms is a form builder that integrates with the Umbraco content management system |
| CVE-2025-46736 | UC Umbraco Cms Umbraco | 5.3 | May 6 | Umbraco is a free and open source .NET content management system |
| CVE-2025-32017 | UC Umbraco Cms Umbraco | 8.8 | Apr 8 | Umbraco is a free and open source .NET content management system |
| CVE-2025-27602 | UC Umbraco Cms Umbraco | 6.4 | Mar 11 | Umbraco is a free and open source .NET content management system |
| CVE-2025-27601 | UC Umbraco Cms Umbraco | 4.3 | Mar 11 | Umbraco is a free and open source .NET content management system |
| CVE-2024-55488 | UC Umbraco Cms Umbraco | 6.5 | Jan 22 | A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload |
| CVE-2025-24012 | UC Umbraco Cms Umbraco | 5.4 | Jan 21 | Umbraco is a free and open source .NET content management system |
| CVE-2025-24011 | UC Umbraco Cms Umbraco | 5.3 | Jan 21 | Umbraco is a free and open source .NET content management system |
| CVE-2025-23041 | UF Umbraco Forms Umbraco | 5.3 | Jan 14 | Umbraco.Forms is a web form framework written for the nuget ecosystem |
| CVE-2024-10761 | UC Umbraco Cms Umbraco | 4.3 | Nov 4 | A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1 |
| CVE-2024-48929 | UC Umbraco Cms Umbraco | 4.2 | Oct 22 | Umbraco is a free and open source .NET content management system |
| CVE-2024-48927 | UC Umbraco Cms Umbraco | 4.6 | Oct 22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x… |
| CVE-2024-48926 | UC Umbraco Cms Umbraco | 3.1 | Oct 22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7,… |
| CVE-2024-48925 | UC Umbraco Cms Umbraco | 6.5 | Oct 22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0 |
| CVE-2024-47819 | UC Umbraco Cms Umbraco | 8.7 | Oct 22 | Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0 |
| CVE-2024-43377 | UC Umbraco Cms Umbraco | 4.3 | Aug 20 | Umbraco CMS is an ASP.NET CMS |
| CVE-2024-43376 | UC Umbraco Cms Umbraco | 5.3 | Aug 20 | Umbraco is an ASP.NET CMS |
| CVE-2024-35239 | UF Umbraco Forms Umbraco | 5.4 | May 28 | Umbraco Commerce is an open source dotnet web forms solution |
| CVE-2024-35218 | UC Umbraco Cms Umbraco | 4.8 | May 21 | Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites |
| CVE-2024-34071 | UC Umbraco Cms Umbraco | 6.1 | May 21 | Umbraco is an ASP.NET CMS used by more than 730.000 websites |
| CVE-2024-29035 | UC Umbraco Cms Umbraco | 5.3 | Apr 17 | Umbraco is an ASP.NET CMS |
| CVE-2024-28868 | UC Umbraco Cms Umbraco | 5.3 | Mar 20 | Umbraco is an ASP.NET content management system |
| CVE-2023-49279 | UC Umbraco Cms Umbraco | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-49278 | UC Umbraco Cms Umbraco | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-49274 | UC Umbraco Cms Umbraco | 5.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-49273 | UC Umbraco Cms Umbraco | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-49089 | UC Umbraco Cms Umbraco | 6.5 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-48313 | UC Umbraco Cms Umbraco | 6.1 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-48227 | UC Umbraco Cms Umbraco | 4.3 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-38694 | UC Umbraco Cms Umbraco | 5.4 | Dec 12 | Umbraco is an ASP.NET content management system (CMS) |
| CVE-2023-37267 | UC Umbraco Cms Umbraco | 9.8 | Jul 13 | Umbraco is a ASP.NET CMS |
| CVE-2023-32312 | UI Umbraco Identity Extensibility Umbraco | 5.3 | Jun 9 | UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration |
| CVE-2019-25137 | UC Umbraco Cms Umbraco | 7.2 | May 18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to… |
| CVE-2021-33224 | UF Umbraco Forms Umbraco | 9.8 | Feb 24 | File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and asp file |
| CVE-2022-22691 | UC Umbraco Cms Umbraco | 7.4 | Jan 18 | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL |
| CVE-2022-22690 | UC Umbraco Cms Umbraco | 7.5 | Jan 18 | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to… |
| CVE-2021-37334 | FO Forms Umbraco | 9.8 | Aug 25 | Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion |
| CVE-2021-34254 | UC Umbraco Cms Umbraco | 6.1 | Jun 28 | Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx |
| CVE-2020-5811 | UC Umbraco Cms Umbraco | 6.5 | Dec 30 | An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of… |
| CVE-2020-5810 | UC Umbraco Cms Umbraco | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current |
| CVE-2020-5809 | UC Umbraco Cms Umbraco | 5.4 | Dec 30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current |
| CVE-2020-29454 | UC Umbraco Cms Umbraco | 4.3 | Dec 2 | Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access |