By vendor

Umbraco vulnerabilities

Known CVEs affecting Umbraco products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-46616MEDIUM 5.4

  Umbraco CMS contains an open-redirect vulnerability in member-related Surface Controllers that fail to properly validate redirect URLs. When a Razor template uses user-controlled query parameters to set a redirect destination, an attacker can craft a malicious link that redirects users to an external site after they interact with the application. This undermines user trust and can be leveraged in phishing campaigns. Versions 13.14.0 and 17.4.0 and later address this issue.

• CVE-2026-46609MEDIUM 4.6

  Umbraco CMS versions 14.0.0 through 17.3.x contain a stored cross-site scripting (XSS) vulnerability in a confirmation dialog. Authenticated users can inject malicious HTML into an input field that gets rendered without proper encoding, allowing attackers to execute arbitrary JavaScript in the context of other users' browsers. This requires an attacker to have valid credentials and typically requires user interaction to trigger the payload.