Frappe - vulnerabilities (CVEs)
311 CVEs in 17 products, 105 in the last 30 days, newest from 2026-10-26.
Products
- Erpnext - 132 CVEs
- Frappe - 70 CVEs
- Lms - 24 CVEs
- Learning - 22 CVEs
- Frappe Framework - 12 CVEs
- Hrms - 8 CVEs
- Press - 6 CVEs
- Frappe Crm - 5 CVEs
- Frappe Hr - 5 CVEs
- Builder - 3 CVEs
- Crm - 3 CVEs
- Frappe Helpdesk - 1 CVEs
- Frappelms - 1 CVEs
- Helpdesk - 1 CVEs
- Hr - 1 CVEs
- Suite - 1 CVEs
- Frappe Lms - 0 CVEs
Newest CVEs of Frappe
- CVE-2026-116492 - CVSS 7.1 (high), 2026-10-26: Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are…
- CVE-2026-115720 - CVSS 5.3 (medium), 2026-10-26: Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only…
- CVE-2026-115717 - CVSS 7.7 (high), 2026-10-26: Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write…
- CVE-2026-115718 - CVSS 5.3 (medium), 2026-10-26: Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated…
- CVE-2026-114664 - CVSS 7.1 (high), 2026-10-22: Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly…
- CVE-2026-111939 - CVSS 5.1 (medium), 2026-10-19: Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other…
- CVE-2026-111938 - CVSS 5.3 (medium), 2026-10-19: Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying…
- CVE-2026-111937 - CVSS 5.4 (medium), 2026-10-19: Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records…
- CVE-2026-64862 - CVSS 6.5 (medium), 2026-10-16: Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not…
- CVE-2026-55796 - CVSS 6.5 (medium), 2026-10-16: Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report…
- CVE-2026-108373 - CVSS 6.5 (medium), 2026-10-16: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction…
- CVE-2026-108374 - CVSS 7.7 (high), 2026-10-16: ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce…
- CVE-2026-111389 - CVSS 8.3 (high), 2026-10-16: Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input…
- CVE-2026-111388 - CVSS 5.4 (medium), 2026-10-16: Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including…
- CVE-2026-55823 - CVSS 8.7 (high), 2026-10-13: Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL…
- CVE-2026-66057 - CVSS 5.1 (medium), 2026-10-13: Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to…
- CVE-2026-109675 - CVSS 5.3 (medium), 2026-10-12: Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs…
- CVE-2026-109674 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote…
- CVE-2026-109673 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not…
- CVE-2026-109672 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
- CVE-2026-109671 - CVSS 8.5 (high), 2026-10-12: Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without…
- CVE-2026-109670 - CVSS 5.4 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without…
- CVE-2026-109669 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper…
- CVE-2026-109668 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing…
- CVE-2026-109667 - CVSS 8.8 (high), 2026-10-12: Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type…
- CVE-2026-109666 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
- CVE-2026-109665 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper…
- CVE-2026-109664 - CVSS 5.3 (medium), 2026-10-12: Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records…
- CVE-2026-109663 - CVSS 7.1 (high), 2026-10-12: Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints.…
- CVE-2026-109662 - CVSS 6.1 (medium), 2026-10-12: Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts…
