Umbraco.CMS vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46609MediumUmbraco.Cms: Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog CVE-2026-46616MediumUmbraco.Cms: Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers CVE-2026-31834HighUmbraco.Cms: Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks CVE-2026-31833MediumUmbraco.Cms: Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering CVE-2026-31832MediumUmbraco.Cms: Umbraco Backoffice API Allows Unauthorized Modification of Domain Data CVE-2025-67288MediumUmbraco.Cms: Umbraco CMS has an arbitrary file upload vulnerability CVE-2025-66625MediumUmbraco.Cms: Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality CVE-2025-49147MediumUmbraco.Cms: Umbraco CMS disclosure of configured password requirements CVE-2025-48953MediumUmbraco.Cms: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads CVE-2025-46736MediumUmbraco.Cms: Umbraco Makes User Enumeration Feasible Based on Timing of Login Response CVE-2025-32017HighUmbraco.Cms: Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users CVE-2024-10761MediumUmbraco.Cms: XSS/HTML Injection Vulnerability in Umbraco Preview Badge CVE-2025-24011MediumUmbraco.Cms: Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes CVE-2024-48929MediumUmbraco.CMS: Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out CVE-2024-48927MediumUmbracoCms: Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice CVE-2024-48926MediumUmbraco.CMS: Umbraco CMS logout page displayed before session expiration CVE-2024-48925LowUmbraco.CMS: Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API CVE-2024-43377MediumUmbraco.Cms: Umbraco CMS Improper Access Control vulnerability CVE-2023-49279LowUmbraco.CMS: Stored XSS via SVG File Upload CVE-2023-49278LowUmbraco.CMS: Brute force exploit can be used to collect valid usernames CVE-2023-49274LowUmbraco.CMS: SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email. CVE-2023-49273MediumUmbraco.CMS: Privilege Escalation using Spoofing CVE-2023-49089LowUmbraco.CMS: Using the directory back payload (“/../”) in a package name allows placement of package in other folders.CVE-2023-48313MediumUmbraco.CMS: DOM-XSS on Backoffice login screen.CVE-2023-48227LowUmbraco.CMS: Backoffice User can bypass "Publish" restriction

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo