Login Request a demo
HR
Product
hrms
by frappe · last CVE Oct 16, 2026
10
CVEs
0
On KEV
7.7
Max CVSS
5
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 2Medium 8Low 0
Severity
All severities10Critical0High2Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hrms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-111389
7.7
0%
Oct 16
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Affected: 14.0.0 before 14.38.2; 15.0.0 before 15.64.0; 16.0.0 before 16.18.0
CVE-2026-54524
7.1
0%
Sep 17
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Affected: < 16.7.0
CVE-2026-64862
6.5
0%
Oct 16
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Affected: < 15.58.3; >= 16.0.0, < 16.4.3
CVE-2026-55796
6.5
0%
Oct 16
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
Affected: < 15.60.3; >= 16.0.0, < 16.7.1
CVE-2026-45081
6.5
0%
May 27
Frappe HR: Permission Bypass in HRMS Leave Details API
Affected: < 16.5.0
CVE-2026-41320
6.5
0%
Apr 21
Frappe HR has possibility of SQL Injection due to improper field sanitization
Affected: < 15.54.0; < 14.38.1
CVE-2026-40889
6.5
0%
Apr 21
Frappe HR has Improper Access Control on Files
Affected: < 16.4.2; < 15.58.2
CVE-2026-40888
6.5
0%
Apr 21
Frappe HR vulnerable to Improper Access Control
Affected: < 15.58.1; < 16.4.1
CVE-2026-108733
4.3
0%
Oct 11
Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Affected: before 16.11.0
CVE-2026-108732
4.3
0%
Oct 11
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Affected: before 16.11.0
Showing 10