Login Request a demo
ER
Product
erpnext
by frappe · last CVE Oct 16, 2026
144
CVEs
0
On KEV
9.9
Max CVSS
70
New 30D
Vulnerabilities144In the news0Timeline
Severity mix
Critical 9High 42Medium 90Low 0
Severity
All severities144Critical9High42Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add erpnext to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-65974
9.9
1%
Aug 17
ERPNext: Server-Side Template Injection leading to Remote Code Execution
Affected: < 15.111.0; >= 16.0.0, < 16.22.0
CVE-2026-72911
9.9
1%
Aug 10
ERPNext: Possibility of server-side template injection due to missing validation
Affected: < 15.118.0; >= 16.0.0, < 16.29.0
CVE-2026-44442
9.9
0%
May 13
ERPNext: Unauthorised Document modification due to missing validation
Affected: < 16.9.1
CVE-2026-38431
9.8
0%
May 5
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI)
Affected: through 15.103.1
CVE-2025-67289
9.6
0%
Dec 22
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file
Affected: 15.89.0
CVE-2026-31017
9.1
0%
Apr 8
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is…
Affected: 16.0.1
CVE-2026-27471
9.1
0%
Feb 21
ERP: Document access through endpoints due to missing validation
Affected: >= 16.0.0-rc.1, < 16.6.1; < 15.98.1
CVE-2025-58439
9.1
0%
Sep 6
ERP is a free and open source Enterprise Resource Planning tool
Affected: before 14.89.2; 15.0.0 before 15.76.0
CVE-2025-65267
9.0
0%
Dec 3
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript
Affected: 15.83.2
Showing 9