Umbraco.cms.core

This hub aggregates every CVE we track for Umbraco.cms.core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 8 most recently published vulnerabilities affecting Umbraco.cms.core.

• CVE-2024-35218Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane4.2May 21, 2024
• CVE-2024-34071Open Redirect Bypass Protection 6.1May 21, 2024
• CVE-2024-29035Umbraco's Blind SSRF Leads to Port Scan by using Webhooks4.1Apr 17, 2024
• CVE-2022-22690Umbraco Remote ApplicationURL Overwrite8.6Jan 18, 2022
• CVE-2022-22691Umbraco Password Reset URL Poison6.8Jan 18, 2022
• CVE-2020-5809A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor...5.4Dec 30, 2020
• CVE-2020-9471Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.8.8Mar 16, 2020
• CVE-2020-7210Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.4.3Jan 23, 2020