Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,582All CVEsplus 19,141 rejected
- 685Last 24 hours2,960 in the last 7 days
- 17,114Last 30 days1,611 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 7 | 0 | 0 | 12 | 52 |
| 2025 | 1 | 1 | 10 | 1 | 0 | 13 | 40 |
| 2024 | 0 | 0 | 12 | 2 | 1 | 15 | 27 |
| 2023 | 0 | 2 | 4 | 4 | 0 | 10 | 12 |
| 2022 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-117553 | Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoningumbraco · Umbraco-CMS | High7.7 |
| CVE-2026-111624 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubsumbraco · Umbraco-CMS | Medium6.3 |
| CVE-2026-69197 | Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionumbraco · Umbraco-CMS | High8.7 |
| CVE-2026-46609 | Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogumbraco · Umbraco-CMS | Medium4.6 |
| CVE-2026-46616 | Umbraco.Cms: Open Redirect Vulnerability in Surface Controllersumbraco · Umbraco-CMS | Medium5.4 |
| CVE-2026-31834 | Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checksumbraco · Umbraco-CMS | High7.2 |
| CVE-2026-31833 | Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filteringumbraco · Umbraco-CMS | Medium6.7 |
| CVE-2026-31832 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Dataumbraco · Umbraco-CMS | Medium5.4 |
| CVE-2026-27449 | Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpointsumbraco · Umbraco.Engage.Forms | High7.5 |
| CVE-2026-24687 | Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Macumbraco · Umbraco.Forms.Issues | Medium6.0 |
| CVE-2025-68924 | In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.Umbraco · Forms | High7.5 |
| CVE-2021-47776 | Umbraco v8.14.1 - 'baseUrl' SSRFumbraco · Umbraco | Medium6.9 |
| CVE-2025-66625 | Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionalityumbraco · Umbraco-CMS | Medium4.9 |
| CVE-2012-10054 | Umbraco CMS < 4.7.1 codeEditorSave.asmx RCEUmbraco · CMS | Critical9.3 |
| CVE-2025-54425 | Umbraco's Delivery API allows for cached requests to be returned with an invalid API keyumbraco · Umbraco-CMS | Medium5.3 |
| CVE-2025-49147 | Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirementsumbraco · Umbraco-CMS | Medium5.3 |
| CVE-2025-48953 | Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploadsumbraco · Umbraco-CMS | Medium5.5 |
| CVE-2025-47280 | Umbraco.Forms has HTML injection vulnerability in 'Send email' workflowumbraco · Umbraco.Forms.Issues | Low2.3 |
| CVE-2025-46736 | Umbraco Makes User Enumeration Feasible Based on Timing of Login Responseumbraco · Umbraco-CMS | Medium5.3 |
| CVE-2025-32017 | Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Usersumbraco · Umbraco-CMS | High8.8 |
| CVE-2025-27602 | Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Contentumbraco · Umbraco-CMS | Medium4.9 |
| CVE-2025-27601 | Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionalityumbraco · Umbraco-CMS | Medium4.3 |
| CVE-2025-24012 | Umbraco Backoffice Components Have XSS/HTML Injection Vulnerabilityumbraco · Umbraco-CMS | Medium4.6 |
| CVE-2025-24011 | Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codesumbraco · Umbraco-CMS | Medium5.3 |
| CVE-2025-23041 | Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Formsumbraco · Umbraco.Forms.Issues | Medium5.8 |
| CVE-2024-10761 | Umbraco CMS Dashboard frame cross site scriptingUmbraco · CMS | Medium6.9 |
| CVE-2024-48929 | Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Outumbraco · Umbraco-CMS | Medium4.2 |
| CVE-2024-48927 | Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backofficeumbraco · Umbraco-CMS | Medium4.6 |
| CVE-2024-48926 | Umbraco CMS logout page displayed before session expirationumbraco · Umbraco-CMS | Medium4.2 |
| CVE-2024-48925 | Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook APIumbraco · Umbraco-CMS | None0.0 |
| CVE-2024-47819 | Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionumbraco · Umbraco-CMS | Medium4.2 |
| CVE-2024-43377 | Umbraco CMS Improper Access Control vulnerabilityumbraco · Umbraco-CMS | Medium5.4 |
| CVE-2024-43376 | Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Informationumbraco · Umbraco-CMS | Medium4.3 |
| CVE-2024-35240 | Stored Cross-site Scripting on Print Functionality in Umbraco Commerceumbraco · Umbraco.Commerce.Issues | Medium5.4 |
| CVE-2024-35239 | Stored Cross-site Scripting on Components of Umbraco Formsumbraco · Umbraco.Forms.Issues | Low2.7 |
| CVE-2024-35218 | Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Paneumbraco · Umbraco-CMS | Medium4.2 |
| CVE-2024-34071 | Open Redirect Bypass Protectionumbraco · Umbraco-CMS | Medium6.1 |
| CVE-2024-32872 | Umbraco Workflow's Backoffice users can execute arbitrary SQLumbraco · Umbraco.Workflow.Issues | Medium5.5 |
| CVE-2024-29035 | Umbraco's Blind SSRF Leads to Port Scan by using Webhooksumbraco · Umbraco-CMS | Medium4.1 |
| CVE-2024-28868 | Umbraco possible user enumeration vulnerabilityumbraco · Umbraco-CMS | Low3.7 |
| CVE-2023-49279 | Umbraco CMS vulnerable to stored XSS via SVG File Uploadumbraco · Umbraco-CMS | Low3.7 |
| CVE-2023-49278 | Umbraco CMS brute force exploit can be used to collect valid usernamesumbraco · Umbraco-CMS | Medium5.3 |
| CVE-2023-49274 | Umbraco CMS SMTP misconfiguration exposes potential registered user emailumbraco · Umbraco-CMS | Low3.7 |
| CVE-2023-49273 | Umbraco CMS vulnerable to Privilege Escalation using Spoofingumbraco · Umbraco-CMS | Medium5.4 |
| CVE-2023-49089 | Umbraco CMS possible path traversal when creating packages from backofficeumbraco · Umbraco-CMS | High7.7 |
| CVE-2023-48313 | Umbraco contains a DOM-XSSumbraco · Umbraco-CMS | Medium4.3 |
| CVE-2023-48227 | Umbraco CMS Backoffice User can bypass "Publish" restrictionumbraco · Umbraco-CMS | Medium4.3 |
| CVE-2023-38694 | Umbraco CMS vulnerable to possible injection of HTML in an unintended formumbraco · Umbraco-CMS | Low3.5 |
| CVE-2023-37267 | Umbraco allows possible Admin-level access to backoffice without Auth under rare conditionsumbraco · Umbraco-CMS | High7.5 |
| CVE-2023-32312 | Client secret not mandatory in UmbracoIdentityExtensionsumbraco · UmbracoIdentityExtensions | Low3.7 |