Login Request a demo
FR
Vendor
frappe
15 products with CVEs on record
342
CVEs
0
On KEV
105
New 30D
Products
ER
erpnext
frappe
9.9
144 CVEs0 on KEV70 new
FR
frappe
frappe
9.8
106 CVEs0 on KEV21 new
HR
hrms
frappe
7.7
10 CVEs0 on KEV5 new
CR
crm
frappe
8.2
6 CVEs0 on KEV4 new
BU
builder
frappe
7.7
3 CVEs0 on KEV3 new
HE
helpdesk
frappe
8.8
2 CVEs0 on KEV1 new
SU
suite
frappe
4.3
1 CVEs0 on KEV1 new
LM
lms
frappe
9.4
23 CVEs0 on KEV0 new
LE
Learning
Frappe
9.8
22 CVEs0 on KEV0 new
FF
Frappe Framework
Frappe
5.1
12 CVEs0 on KEV0 new
PR
press
frappe
7.5
6 CVEs0 on KEV0 new
FH
Frappe HR
Frappe
6.5
3 CVEs0 on KEV0 new
FC
Frappe CRM
Frappe
8.8
2 CVEs0 on KEV0 new
FH
Frappe HelpDesk
Frappe
8.8
1 CVEs0 on KEV0 new
HR
HR
Frappe
4.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116492
New
CR
crm
frappe
6.5
0%
Oct 26Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115720
New
BU
builder
frappe
5.0
0%
Oct 26Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
CVE-2026-115717
New
BU
builder
frappe
7.7
0%
Oct 26Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115718
New
BU
builder
frappe
4.3
0%
Oct 26Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
CVE-2026-114664
FR
frappe
frappe
7.1
0%
Oct 22Frappe before 16.33.0 Blind SQL Injection via get_events
CVE-2026-111939
HE
helpdesk
frappe
4.6
0%
Oct 19Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
CVE-2026-111938
CR
crm
frappe
4.3
0%
Oct 19Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
CVE-2026-111937
CR
crm
frappe
5.4
0%
Oct 19Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
CVE-2026-64862
HR
hrms
frappe
6.5
0%
Oct 16Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
CVE-2026-55796
HR
hrms
frappe
6.5
0%
Oct 16Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
CVE-2026-108373
ER
erpnext
frappe
6.5
0%
Oct 16ERPNext: Unauthorised access to financial data due to missing validation
CVE-2026-108374
ER
erpnext
frappe
7.7
0%
Oct 16ERPNext: Unauthorised status modification due to missing validation
CVE-2026-111389
HR
hrms
frappe
7.7
0%
Oct 16Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
CVE-2026-111388
FR
frappe
frappe
5.4
0%
Oct 16Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
CVE-2026-55823
FR
frappe
frappe
8.7
0%
Oct 13Frappe: Possibility of SQL injection in reportview
CVE-2026-66057
FR
frappe
frappe
5.1
0%
Oct 13Frappe: Open Redirect via Unsanitized OAuth State Param.
CVE-2026-109675
SU
suite
frappe
4.3
0%
Oct 12Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
CVE-2026-109674
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
CVE-2026-109673
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
CVE-2026-109672
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
CVE-2026-109671
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
CVE-2026-109670
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
CVE-2026-109669
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
CVE-2026-109668
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
CVE-2026-109667
ER
erpnext
frappe
8.8
0%
Oct 12Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
CVE-2026-109666
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
CVE-2026-109665
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
CVE-2026-109664
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
CVE-2026-109663
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
CVE-2026-109662
ER
erpnext
frappe
6.1
0%
Oct 12Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
CVE-2026-109661
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
CVE-2026-109660
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
CVE-2026-109659
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
CVE-2026-109658
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
CVE-2026-109657
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
CVE-2026-109656
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
CVE-2026-109655
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
CVE-2026-109654
ER
erpnext
frappe
5.4
0%
Oct 12Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
CVE-2026-109653
ER
erpnext
frappe
7.3
0%
Oct 12Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
CVE-2026-109652
ER
erpnext
frappe
8.8
0%
Oct 12Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
CVE-2026-109651
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
CVE-2026-109650
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
CVE-2026-109649
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-109648
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
CVE-2026-109647
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-109646
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-109645
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
CVE-2026-109644
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
CVE-2026-109643
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
CVE-2026-109642
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
CVE-2026-109641
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
CVE-2026-109640
ER
erpnext
frappe
8.1
0%
Oct 12Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
CVE-2026-109639
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-109638
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
CVE-2026-109637
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
CVE-2026-109636
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
CVE-2026-109635
ER
erpnext
frappe
4.3
0%
Oct 12Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
CVE-2026-109634
ER
erpnext
frappe
4.9
0%
Oct 12Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
CVE-2026-109633
ER
erpnext
frappe
8.1
0%
Oct 12Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
CVE-2026-109632
ER
erpnext
frappe
6.5
0%
Oct 12Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints