Kentico has 3 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 5.4 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Weakness classes
Products
- Xperience 3
Worst active — by depth score
CVE-2020-36890High· 7.2An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests40CVE-2025-5591Medium· 5.4Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.30CVE-2026-105046Medium· 4.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.24
Kentico vulnerabilities
CVEs affecting Kentico, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-105046Medium· 4.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
CVE-2025-5591Medium· 5.4Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and perform actions in their security context.
CVE-2020-36890High· 7.2An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalida…