frappe vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116492 Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are notHigh 7.1 · Oct 26, 2026
• CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly nHigh 7.1 · Oct 21, 2026
• CVE-2026-108374 ERPNext is a free and open source Enterprise Resource Planning tool.High 7.7 · Oct 16, 2026
• CVE-2026-111389 Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input vHigh 8.3 · Oct 15, 2026
• CVE-2026-55823 Frappe is a full-stack web application framework.High 8.7 · Oct 13, 2026
• CVE-2026-109674 Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation.High 7.1 · Oct 12, 2026
• CVE-2026-109673 Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properlHigh 8.5 · Oct 12, 2026
• CVE-2026-109672 Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorizaHigh 7.1 · Oct 12, 2026
• CVE-2026-109671 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escapingHigh 8.5 · Oct 12, 2026
• CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type frHigh 8.7 · Oct 12, 2026
• CVE-2026-109666 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permissioHigh 7.1 · Oct 12, 2026
• CVE-2026-109663 Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints.High 7.1 · Oct 12, 2026
• CVE-2026-109661 Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorizaHigh 7.1 · Oct 12, 2026
• CVE-2026-109660 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify productioHigh 7.1 · Oct 12, 2026
• CVE-2026-109659 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permissiHigh 7.1 · Oct 12, 2026
• CVE-2026-109658 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorizHigh 7.1 · Oct 12, 2026
• CVE-2026-109656 Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorizHigh 7.1 · Oct 12, 2026
• CVE-2026-109655 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-baseHigh 7.1 · Oct 12, 2026
• CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attrHigh 8.5 · Oct 12, 2026
• CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not vaHigh 8.7 · Oct 12, 2026
• CVE-2026-109650 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorizaHigh 7.1 · Oct 12, 2026
• CVE-2026-109649 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipHigh 7.1 · Oct 12, 2026
• CVE-2026-109648 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.High 7.1 · Oct 12, 2026
• CVE-2026-109647 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation.High 7.1 · Oct 12, 2026
• CVE-2026-109646 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation.High 7.1 · Oct 12, 2026