Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-46609
4.6
MEDIUMCVSS v3
Published
June 10, 2026
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper output encoding. This issue has been patched in version 17.4.0.
umbraco/Umbraco-CMS
GitHubUmbraco is a free and open source .NET content management system helping you deliver delightful digital experiences.
GitHubUmbraco is a free and open source .NET content management system helping you deliver delightful digital experiences.>= 14.0.0, < 17.4.0NVD