Login Request a demo
FR
Product
frappe
by frappe · last CVE Oct 22, 2026
105
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Vulnerabilities105In the news0Timeline
Severity mix
Critical 9High 31Medium 62Low 3
Severity
All severities105Critical9High31Medium62Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add frappe to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-35614
9.8
0%
Apr 7
Frappe has a SQL injection in bulk_update
Affected: < 15.104.0; >= 16.0.0-beta.1, < 16.14.0
CVE-2026-31877
9.8
0%
Mar 11
Frappe is a full-stack web application framework
Affected: before 14.99.0; 15.0.0 before 15.84.0
CVE-2025-66205
9.8
0%
Dec 1
Frappe is a full-stack web application framework
Affected: before 14.99.2; 15.0.0 before 15.86.0
CVE-2019-14965
9.8
3%
Aug 12
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4
Affected: 10.0.0 before 12.0.4
CVE-2025-67289
9.6
0%
Dec 22
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file
Affected: 15.89.0
CVE-2026-31017
9.1
0%
Apr 8
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is…
Affected: 16.1.1
CVE-2026-39351
9.1
0%
Apr 7
Frappe allows unrestricted Doctype access via API exploit
Affected: < 15.104.0; >= 16.0.0-beta.1, < 16.14.0
CVE-2025-68929
9.0
0%
Dec 29
Frappe is a full-stack web application framework
Affected: before 14.99.6; 15.0.0 before 15.88.1
CVE-2025-65267
9.0
0%
Dec 3
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript
Affected: 15.86.0
Showing 9