Login Request a demo
FR
Product
frappe
by frappe · last CVE Oct 29, 2026
111
CVEs
0
On KEV
9.9
Max CVSS
23
New 30D
Vulnerabilities111In the news0Timeline
Severity mix
Critical 10High 33Medium 63Low 3
Severity
All severities111Critical10High33Medium63Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add frappe to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-119145
New
9.9–Oct 29
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
Affected: 16.0.0 before 16.34.0; before 15.121.0
CVE-2026-35614
9.8
0%
Apr 7
Frappe has a SQL injection in bulk_update
Affected: < 15.104.0; >= 16.0.0-beta.1, < 16.14.0
CVE-2026-31877
9.8
0%
Mar 11
Frappe SQL Injection due to improper field sanitization
Affected: >= 15.0.0, < 15.84.0; < 14.99.0
CVE-2025-66205
9.8
0%
Dec 1
Frappe has the possibility of SQL Injection due to improper validations
Affected: >= 15.0.0, < 15.86.0; < 14.99.2
CVE-2019-14965
9.8
3%
Aug 12
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4
Affected: 10.0.0 before 12.0.4
CVE-2025-67289
9.6
0%
Dec 22
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file
Affected: 15.89.0
CVE-2026-31017
9.1
0%
Apr 8
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is…
Affected: 16.1.1
CVE-2026-39351
9.1
0%
Apr 7
Frappe allows unrestricted Doctype access via API exploit
Affected: < 15.104.0; >= 16.0.0-beta.1, < 16.14.0
CVE-2025-68929
9.0
0%
Dec 29
Frappe may be vulnerable remote code execution due to server-side template injection
Affected: < 14.99.6; >= 15.0.0, < 15.88.1
CVE-2025-65267
9.0
0%
Dec 3
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript
Affected: 15.86.0
Showing 10