Frappe ERPNext

• CVE-2026-124316 Medium 4.3 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests –
• CVE-2026-124315 Medium 6.5 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items –
• CVE-2026-124314 Medium 6.5 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities –
• CVE-2026-124313 Medium 4.3 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc –
• CVE-2026-108373 Medium 6.5 ERPNext: Unauthorised access to financial data due to missing validation 0.2%
• CVE-2026-108374 High 7.7 ERPNext: Unauthorised status modification due to missing validation 0.2%
• CVE-2026-109674 Medium 6.5 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation 0.3%
• CVE-2026-109673 High 7.3 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names 0.2%
• CVE-2026-109672 Medium 6.5 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109671 High 7.3 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages 0.2%
• CVE-2026-109670 Medium 5.4 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name 0.2%
• CVE-2026-109669 Medium 4.3 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification 0.2%
• CVE-2026-109668 Medium 4.3 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints 0.2%
• CVE-2026-109667 High 8.8 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation 0.2%
• CVE-2026-109666 Medium 6.5 Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints 0.2%
• CVE-2026-109665 Medium 4.3 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation 0.2%
• CVE-2026-109664 Medium 4.3 Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification 0.2%
• CVE-2026-109663 Medium 6.5 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters 0.3%
• CVE-2026-109662 Medium 6.1 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form 0.2%
• CVE-2026-109661 Medium 6.5 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109660 Medium 6.5 Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints 0.2%
• CVE-2026-109659 Medium 6.5 Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109658 Medium 6.5 Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints 0.3%
• CVE-2026-109657 Medium 5.4 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name 0.2%
• CVE-2026-109656 Medium 6.5 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access 0.3%
• CVE-2026-109655 Medium 6.5 Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints 0.2%
• CVE-2026-109654 Medium 5.4 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints 0.2%
• CVE-2026-109653 High 7.3 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover 0.2%
• CVE-2026-109652 High 8.8 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields 0.3%
• CVE-2026-109651 Medium 4.3 Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field 0.2%
• CVE-2026-109650 Medium 6.5 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data 0.3%
• CVE-2026-109649 Medium 6.5 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests 0.3%
• CVE-2026-109648 Medium 6.5 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation 0.3%
• CVE-2026-109647 Medium 6.5 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation 0.3%
• CVE-2026-109646 Medium 6.5 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation 0.3%
• CVE-2026-109645 Medium 6.5 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization 0.2%
• CVE-2026-109644 Medium 6.5 Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data 0.3%
• CVE-2026-109643 Medium 6.5 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data 0.3%
• CVE-2026-109642 Medium 4.3 Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints 0.2%
• CVE-2026-109641 Medium 6.5 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints 0.3%
• CVE-2026-109640 High 8.1 Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification 0.2%
• CVE-2026-109639 Medium 6.5 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests 0.3%
• CVE-2026-109638 Medium 6.5 Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation 0.3%
• CVE-2026-109637 Medium 6.5 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification 0.2%
• CVE-2026-109636 Medium 6.5 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data 0.3%
• CVE-2026-109635 Medium 4.3 Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints 0.2%
• CVE-2026-109634 Medium 4.9 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints 0.3%
• CVE-2026-109633 High 8.1 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page 0.2%
• CVE-2026-109632 Medium 6.5 Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints 0.3%
• CVE-2026-109631 Medium 6.5 Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation 0.3%