Login Request a demo
FR
Vendor
frappe
14 products with CVEs on record
313
CVEs
0
On KEV
105
New 30D
Products
ER
erpnext
frappe
9.9
144 CVEs0 on KEV70 new
FR
frappe
frappe
9.8
105 CVEs0 on KEV21 new
HR
hrms
frappe
7.7
7 CVEs0 on KEV5 new
CR
crm
frappe
8.2
5 CVEs0 on KEV4 new
BU
builder
frappe
7.7
3 CVEs0 on KEV3 new
HE
helpdesk
frappe
8.8
2 CVEs0 on KEV1 new
SU
suite
frappe
4.3
1 CVEs0 on KEV1 new
LE
Learning
Frappe
9.8
22 CVEs0 on KEV0 new
FF
Frappe Framework
Frappe
5.1
12 CVEs0 on KEV0 new
LM
lms
frappe
9.4
4 CVEs0 on KEV0 new
FH
Frappe HR
Frappe
6.5
3 CVEs0 on KEV0 new
FC
Frappe Crm
Frappe
8.8
2 CVEs0 on KEV0 new
PR
Press
Frappe
7.5
2 CVEs0 on KEV0 new
HR
HR
Frappe
4.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116492
New
CR
crm
frappe
6.5
0%
Oct 26Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115720
New
BU
builder
frappe
5.0
0%
Oct 26Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
CVE-2026-115717
New
BU
builder
frappe
7.7
0%
Oct 26Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115718
New
BU
builder
frappe
4.3
0%
Oct 26Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
CVE-2026-114664
New
FR
frappe
frappe
7.1
0%
Oct 22Frappe before 16.33.0 Blind SQL Injection via get_events
CVE-2026-111939
HE
helpdesk
frappe
4.6
0%
Oct 19Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVE-2026-111938
CR
crm
frappe
4.3
0%
Oct 19Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
CVE-2026-111937
CR
crm
frappe
5.4
0%
Oct 19Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
CVE-2026-64862
HR
hrms
frappe
6.5
0%
Oct 16Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
CVE-2026-55796
HR
hrms
frappe
6.5
0%
Oct 16Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
CVE-2026-108373
ER
erpnext
frappe
6.5
0%
Oct 16ERPNext: Unauthorised access to financial data due to missing validation
CVE-2026-108374
ER
erpnext
frappe
7.7
0%
Oct 16ERPNext: Unauthorised status modification due to missing validation
CVE-2026-111389
HR
hrms
frappe
7.7
0%
Oct 16Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
CVE-2026-111388
FR
frappe
frappe
5.4
0%
Oct 16Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
CVE-2026-55823
FR
frappe
frappe
8.7
0%
Oct 13Frappe: Possibility of SQL injection in reportview
CVE-2026-66057
FR
frappe
frappe
5.1
0%
Oct 13Frappe: Open Redirect via Unsanitized OAuth State Param.
CVE-2026-109675
SU
suite
frappe
4.3
0%
Oct 12Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
CVE-2026-109674
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
CVE-2026-109673
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
CVE-2026-109672
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
CVE-2026-109671
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
CVE-2026-109670
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
CVE-2026-109669
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
CVE-2026-109668
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
CVE-2026-109667
ER
erpnext
frappe
8.8
0%
Oct 12Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
CVE-2026-109666
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
CVE-2026-109665
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
CVE-2026-109664
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
CVE-2026-109663
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
CVE-2026-109662
ER
erpnext
frappe
6.1
0%
Oct 12Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
CVE-2026-109661
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
CVE-2026-109660
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
CVE-2026-109659
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
CVE-2026-109658
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
CVE-2026-109657
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
CVE-2026-109656
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
CVE-2026-109655
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
CVE-2026-109654
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
CVE-2026-109653
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
CVE-2026-109652
ER
erpnext
frappe
8.8
0%
Oct 12Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
CVE-2026-109651
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
CVE-2026-109650
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
CVE-2026-109649
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-109648
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
CVE-2026-109647
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-109646
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-109645
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
CVE-2026-109644
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
CVE-2026-109643
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
CVE-2026-109642
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
CVE-2026-109641
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
CVE-2026-109640
ER
erpnext
frappe
8.1
0%
Oct 12Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
CVE-2026-109639
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-109638
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
CVE-2026-109637
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
CVE-2026-109636
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
CVE-2026-109635
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
CVE-2026-109634
ER
erpnext
frappe
4.9
0%
Oct 12Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
CVE-2026-109633
ER
erpnext
frappe
8.1
0%
Oct 12Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
CVE-2026-109632
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints