CVE-2026-111937 MEDIUM 5.3 Crm — Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users … 2026-10-19 CVE-2026-111938 MEDIUM 5.3 Crm — Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users … 2026-10-19 CVE-2026-111939 MEDIUM 5.1 Helpdesk — Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal … 2026-10-19 CVE-2026-108373 MEDIUM 6.5 Erpnext — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain en… 2026-10-16 CVE-2026-108374 HIGH 7.7 Erpnext — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain en… 2026-10-16 CVE-2026-111388 MEDIUM 5.3 Frappe — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist f… 2026-10-16 CVE-2026-111389 HIGH 8.3 Hrms — Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnera… 2026-10-16 CVE-2026-55796 MEDIUM 6.5 Hrms — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salar… 2026-10-16 CVE-2026-64862 MEDIUM 6.5 Hrms — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA … 2026-10-16 CVE-2026-55823 HIGH 8.7 Frappe — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo… 2026-10-13 CVE-2026-66057 MEDIUM 5.1 Frappe — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an … 2026-10-13 CVE-2026-109376 MEDIUM 5.3 Erpnext — ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html me… 2026-10-12 CVE-2026-109377 MEDIUM 5.3 Erpnext — ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users t… 2026-10-12 CVE-2026-109598 MEDIUM 5.3 Frappe — Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the… 2026-10-12 CVE-2026-109599 MEDIUM 5.3 Frappe — Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain… 2026-10-12 CVE-2026-109600 MEDIUM 6.9 Frappe — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef… 2026-10-12 CVE-2026-109601 HIGH 7.1 Frappe — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the … 2026-10-12 CVE-2026-109602 MEDIUM 5.1 Frappe — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa… 2026-10-12 CVE-2026-109603 MEDIUM 4.8 Frappe — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-… 2026-10-12 CVE-2026-109604 HIGH 8.5 Erpnext — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability be… 2026-10-12 CVE-2026-109608 HIGH 8.7 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endp… 2026-10-12 CVE-2026-109609 HIGH 7.1 Erpnext — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109610 HIGH 7.1 Erpnext — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because … 2026-10-12 CVE-2026-109611 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109612 HIGH 8.5 Erpnext — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in… 2026-10-12 CVE-2026-109613 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109614 HIGH 7.1 Erpnext — Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users t… 2026-10-12 CVE-2026-109615 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109616 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109617 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109621 HIGH 7.1 Erpnext — Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that ho… 2026-10-12 CVE-2026-109622 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109623 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109624 HIGH 7.1 Erpnext — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109625 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109626 HIGH 7.1 Erpnext — Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in mu… 2026-10-12 CVE-2026-109627 HIGH 7.1 Erpnext — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109628 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109629 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an en… 2026-10-12 CVE-2026-109630 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109631 HIGH 7.1 Erpnext — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109632 HIGH 7.1 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109633 HIGH 8.6 Erpnext — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability be… 2026-10-12 CVE-2026-109634 MEDIUM 6.9 Erpnext — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109635 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109636 HIGH 7.1 Erpnext — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because … 2026-10-12 CVE-2026-109637 HIGH 7.1 Erpnext — Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users t… 2026-10-12 CVE-2026-109638 HIGH 7.1 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoint… 2026-10-12 CVE-2026-109639 HIGH 7.1 Erpnext — Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoint… 2026-10-12 CVE-2026-109640 HIGH 7.2 Erpnext — Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users t… 2026-10-12 CVE-2026-109641 MEDIUM 6.9 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109642 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109643 HIGH 7.1 Erpnext — Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109644 HIGH 7.1 Erpnext — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109645 HIGH 7.1 Erpnext — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109646 HIGH 7.1 Erpnext — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109647 HIGH 7.1 Erpnext — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple end… 2026-10-12 CVE-2026-109648 HIGH 7.1 Erpnext — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109649 HIGH 7.1 Erpnext — Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoin… 2026-10-12 CVE-2026-109650 HIGH 7.1 Erpnext — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109651 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability ca… 2026-10-12 CVE-2026-109652 HIGH 8.7 Erpnext — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability… 2026-10-12 CVE-2026-109653 HIGH 8.5 Erpnext — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability be… 2026-10-12 CVE-2026-109654 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109655 HIGH 7.1 Erpnext — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109656 HIGH 7.1 Erpnext — Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109657 MEDIUM 5.1 Erpnext — Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with… 2026-10-12 CVE-2026-109658 HIGH 7.1 Erpnext — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109659 HIGH 7.1 Erpnext — Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109660 HIGH 7.1 Erpnext — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper author… 2026-10-12 CVE-2026-109661 HIGH 7.1 Erpnext — Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109662 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in… 2026-10-12 CVE-2026-109663 HIGH 7.1 Erpnext — Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missi… 2026-10-12 CVE-2026-109664 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users … 2026-10-12 CVE-2026-109665 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109666 HIGH 7.1 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109667 HIGH 8.7 Erpnext — Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a reco… 2026-10-12 CVE-2026-109668 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109669 MEDIUM 5.3 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which… 2026-10-12 CVE-2026-109670 MEDIUM 5.1 Erpnext — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability ca… 2026-10-12 CVE-2026-109671 HIGH 8.5 Erpnext — Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in… 2026-10-12 CVE-2026-109672 HIGH 7.1 Erpnext — Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certa… 2026-10-12 CVE-2026-109673 HIGH 8.5 Erpnext — Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability be… 2026-10-12 CVE-2026-109674 HIGH 7.1 Erpnext — Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints… 2026-10-12 CVE-2026-109675 MEDIUM 5.3 Suite — Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerabi… 2026-10-12 CVE-2025-71430 MEDIUM 5.1 Frappe — Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the lea… 2026-10-12 CVE-2025-71431 MEDIUM 6.3 Frappe — Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoin… 2026-10-12 CVE-2025-71432 HIGH 8.6 Erpnext — Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability … 2026-10-12 CVE-2026-108732 MEDIUM 5.3 Hrms — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth…● PoC 2026-10-11 CVE-2026-108733 MEDIUM 5.3 Hrms — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth… 2026-10-11 CVE-2026-108734 MEDIUM 5.3 Crm — Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs… 2026-10-11 CVE-2026-101006 MEDIUM 5.3 Hr — A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/g… 2026-09-28 CVE-2026-96672 MEDIUM 5.3 Erpnext — Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula val… 2026-09-23 CVE-2026-94113 HIGH 7.1 Erpnext — Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerabilit… 2026-09-20 CVE-2026-54343 HIGH 8.7 Lms — Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior t… 2026-09-17 CVE-2026-54524 HIGH 7.1 Hrms — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user… 2026-09-17