Frappe ERPNext

• CVE-2026-109630 Medium 4.3 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints 0.2%
• CVE-2026-109629 Medium 4.3 Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint 0.2%
• CVE-2026-109628 Medium 6.5 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization 0.2%
• CVE-2026-109627 Medium 6.5 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109626 Medium 6.5 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints 0.3%
• CVE-2026-109625 Medium 6.5 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109624 Medium 6.5 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data 0.3%
• CVE-2026-109623 Medium 5.4 Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization 0.2%
• CVE-2026-109622 Medium 4.3 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization 0.2%
• CVE-2026-109621 Medium 6.5 Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass 0.3%
• CVE-2026-109617 High 7.1 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints 0.2%
• CVE-2026-109616 High 7.1 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification 0.2%
• CVE-2026-109615 Medium 6.5 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints 0.2%
• CVE-2026-109614 Medium 6.5 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109613 High 7.1 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification 0.3%
• CVE-2026-109612 High 7.3 Frappe ERPNext before 15.120.0 Stored XSS via Report View 0.2%
• CVE-2026-109611 Medium 4.3 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints 0.2%
• CVE-2026-109610 Medium 6.5 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification 0.2%
• CVE-2026-109609 Medium 6.5 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation 0.3%
• CVE-2026-109608 High 8.8 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input 0.3%
• CVE-2026-109604 High 7.3 ERPNext before 15.112.0 Stored XSS via Tool View Record Names 0.2%
• CVE-2025-71432 High 8.1 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover 0.3%
• CVE-2026-109377 Medium 4.3 ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods 0.3%
• CVE-2026-109376 Medium 4.3 ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html 0.3%
• CVE-2026-96672 Medium 6.4 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation 0.4%
• CVE-2026-94113 Medium 6.5 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints 0.4%
• CVE-2026-65822 High 7.6 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter 0.5%
• CVE-2026-65974 Critical 9.9 ERPNext: Server-Side Template Injection leading to Remote Code Execution 1.0%
• CVE-2026-72911 Critical 9.9 ERPNext: Possibility of server-side template injection due to missing validation 0.7%
• CVE-2026-72910 High 7.1 ERPNext: Unauthorised modification of master data due to missing validation 0.5%
• CVE-2026-72909 High 7.1 ERPNext: Broken Access Control on certain endpoints 0.5%
• CVE-2026-72908 Medium 6.5 ERPNext: Possibility of SQL injection due to missing validation 0.5%
• CVE-2026-72907 Medium 6.5 ERPNext: Broken Access Control on certain endpoint 0.4%
• CVE-2026-72906 Medium 4.3 ERPNext: Unauthorised triggering of automated emails due to missing validation 0.4%
• CVE-2026-13227 High 7.1 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API 0.3%
• CVE-2026-12895 High 7.1 SQL Injection in Frappe's ERPNext 0.4%
• CVE-2026-55242 High 8.8 ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix 0.2%
• CVE-2026-42839 Medium 4.8 ERPNext 16.16.0 - Stored XSS in POS cart item rendering 0.3%
• CVE-2026-42840 Medium 5.1 ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals 0.2%
• CVE-2026-44448 Medium 5.9 ERPNext: Unauthorised Document modification due to missing validation 0.1%
• CVE-2026-44447 High 8.8 ERPNext: Possibility of SQL Injection due to missing validation 0.3%
• CVE-2026-44446 High 8.8 ERPNext: Possibility of SQL Injection due to missing validation 0.3%
• CVE-2026-44445 Medium 5.3 ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module 0.2%
• CVE-2026-44441 Medium 5.0 ERPNext: Possible SSRF by any authenticated user 0.2%
• CVE-2026-44440 Medium 6.5 ERPNext: Path Traversal Leading to Sensitive File Exposure 0.4%
• CVE-2026-44442 Critical 9.9 ERPNext: Unauthorised Document modification due to missing validation 0.3%
• CVE-2026-32954 High 7.1 ERP has a possibility SQL Injection vulnerability due to missing validation 0.3%
• CVE-2026-27471 Critical 9.3 ERP: Document access through endpoints due to missing validation 0.4%
• CVE-2025-58439 High 8.1 ERP: Possibility of SQL injection due to missing validation 0.3%