Priority LOW 36
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00495 · Published 2026-10-27 · Fixed in 17.7.2, 18.2.2 CWE-601
Priority LOW 28
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00309 · Published 2026-10-16 · Fixed in 17.7.1, 18.2.1 CWE-306
Priority MEDIUM 45
Umbraco is an ASP.NET CMS.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00662 · Published 2026-09-17 · Fixed in 13.15.1, 17.5.3 +1 CWE-200
Priority LOW 20
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00136 · Published 2026-06-10 · Fixed in 17.4.0 CWE-79
Priority LOW 26
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0018 · Published 2026-06-10 · Fixed in 13.14.0, 17.4.0 CWE-601
Priority LOW 34
Umbraco is an ASP.NET CMS.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00376 · Published 2026-03-10 · Fixed in 16.5.1, 17.2.1 +1 CWE-269
Priority LOW 31
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 6.7· Network · High privileges · No interaction · EPSS 0.00302 · Published 2026-03-10 · Fixed in 16.5.1, 17.2.1 +1 CWE-79
Priority LOW 24
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00208 · Published 2026-03-10 · Fixed in 16.5.1, 17.2.0 +1 CWE-639
Priority LOW 39
Umbraco Engage is a business intelligence platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00408 · Published 2026-02-26 · Fixed in 16.2.1, 17.1.1 CWE-284
Priority LOW 27
Umbraco Forms is a form builder that integrates with the Umbraco content management system.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00456 · Published 2026-01-29 · Fixed in 16.4.1, 17.1.1 CWE-22
Priority LOW 36
In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00755 · Published 2026-01-16 · No fix listed CWE-829
Priority HIGH 70
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0038 · Published 2026-01-15 · No fix listed CWE-918
Priority HIGH 82
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-12-22 · No fix listed CWE-434
Priority LOW 22
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00357 · Published 2025-12-09 · Fixed in 13.12.1 CWE-200
Priority HIGH 81
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without a…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.04347 · Published 2025-08-13 · Fixed in 4.7.1 CWE-22
Priority LOW 30
Umbraco is an ASP.NET CMS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0039 · Published 2025-07-30 · Fixed in 13.9.3, 15.4.4 +1 CWE-200
Priority LOW 30
Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00343 · Published 2025-06-24 · Fixed in 10.8.111, 13.9.2 +1 CWE-497
Priority LOW 28
Umbraco is an ASP.NET content management system (CMS).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00193 · Published 2025-06-03 · Fixed in 15.4.2 CWE-434
Priority LOW 12
Umbraco Forms is a form builder that integrates with the Umbraco content management system.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.003 · Published 2025-05-13 · Fixed in 13.4.2, 15.1.2 CWE-116
Priority LOW 30
Umbraco is a free and open source .NET content management system.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00389 · Published 2025-05-06 · Fixed in 13.8.1, 10.8.10 CWE-204
Priority LOW 39
Umbraco is a free and open source .NET content management system.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00646 · Published 2025-04-08 · Fixed in 14.3.4, 15.3.1 CWE-23
Priority LOW 28
Umbraco is a free and open source .NET content management system.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-03-11 · Fixed in 10.8.9, 13.7.1 CWE-285
Priority LOW 20
Umbraco is a free and open source .NET content management system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00323 · Published 2025-03-11 · Fixed in 15.2.3, 14.3.3 CWE-285
Priority HIGH 68
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00332 · Published 2025-01-22 · No fix listed CWE-79
Priority LOW 24
Umbraco is a free and open source .NET content management system.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00275 · Published 2025-01-21 · Fixed in 14.3.2, 15.1.2 CWE-79
Load more
THREATIST.IORead the docs