Builder (Frappe) - vulnerabilities (CVEs)

3 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-26. Vendor: Frappe.

CVEs of Builder

• CVE-2026-115720 - CVSS 5.3 (medium), 2026-10-26: Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only…
• CVE-2026-115717 - CVSS 7.7 (high), 2026-10-26: Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write…
• CVE-2026-115718 - CVSS 5.3 (medium), 2026-10-26: Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated…