https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:01:42.499690+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-160312 EUVD-2026-160312 2026-10-07T01:01:42.503842+00:00 EUVD-2026-160312 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49279 fkie_cve-2023-49279 2026-10-07T01:01:42.503877+00:00

Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted.

 https://cve.radiocsirt.org/vuln/ghsa-6xmx-85x3-4cv2 GHSA-6xmx-85x3-4cv2 — Stored XSS via SVG File Upload 2026-10-07T01:01:42.503911+00:00

Affected: NuGet: Umbraco.CMS

#### Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed.

#### Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation

or

Serve all media from an different host (e.g cdn) that where umbraco is hosted

 https://cve.radiocsirt.org/vuln/gsd-2023-49279 gsd-2023-49279 2026-10-07T01:01:42.503941+00:00 gsd-2023-49279