Umbraco vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 202310
3. 202415
4. 202513
5. 202612

Newest CVEs

• CVE-2026-117553

  Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

  umbraco · Umbraco-CMS

  High7.7
• CVE-2026-111624

  Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

  umbraco · Umbraco-CMS

  Medium6.3
• CVE-2026-69197

  Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

  umbraco · Umbraco-CMS

  High8.7
• CVE-2026-46609

  Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

  umbraco · Umbraco-CMS

  Medium4.6
• CVE-2026-46616

  Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

  umbraco · Umbraco-CMS

  Medium5.4
• CVE-2026-31834

  Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

  umbraco · Umbraco-CMS

  High7.2
• CVE-2026-31833

  Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

  umbraco · Umbraco-CMS

  Medium6.7
• CVE-2026-31832

  Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

  umbraco · Umbraco-CMS

  Medium5.4
• CVE-2026-27449

  Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

  umbraco · Umbraco.Engage.Forms

  High7.5
• CVE-2026-24687

  Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac

  umbraco · Umbraco.Forms.Issues

  Medium6.0