What’s Vulnerable › Products

Umbraco-CMS vulnerabilities

59 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your Umbraco-CMS version is affected

Latest Umbraco-CMS vulnerabilities

• CVE-2026-117553 — Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning (CVSS 7.5)
• CVE-2026-111624 — Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs (CVSS 3.7)
• CVE-2026-69197 — Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion (CVSS 8.7)
• CVE-2026-46616 — Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers (CVSS 6.1)
• CVE-2026-46609 — Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog (CVSS 4.6)
• CVE-2026-31834 — Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks (CVSS 7.2)
• CVE-2026-31833 — Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering (CVSS 6.7)
• CVE-2026-31832 — Umbraco Backoffice API Allows Unauthorized Modification of Domain Data (CVSS 5.4)
• CVE-2021-47776 — Umbraco v8.14.1 - 'baseUrl' SSRF (CVSS 5.3)
• CVE-2025-67288 — (CVSS 10.0)
• CVE-2025-66625 — Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality (CVSS 4.9)
• CVE-2012-10054 — Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE (CVSS 9.8)
• CVE-2025-54425 — Umbraco's Delivery API allows for cached requests to be returned with an invalid API key (CVSS 5.3)
• CVE-2025-49147 — Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements (CVSS 5.3)
• CVE-2025-48953 — Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads (CVSS 6.5)
• CVE-2025-46736 — Umbraco Makes User Enumeration Feasible Based on Timing of Login Response (CVSS 5.3)
• CVE-2025-32017 — Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users (CVSS 8.8)
• CVE-2025-27602 — Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content (CVSS 6.4)
• CVE-2025-27601 — Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality (CVSS 4.3)
• CVE-2024-55488 — (CVSS 6.5)
• CVE-2025-24012 — Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability (CVSS 5.4)
• CVE-2025-24011 — Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes (CVSS 5.3)
• CVE-2024-10761 — Umbraco CMS Dashboard frame cross site scripting (CVSS 4.3)
• CVE-2024-48929 — Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out (CVSS 4.2)
• CVE-2024-48927 — Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice (CVSS 4.6)