Frappe hrms

• CVE-2026-121442 Medium 4.3 Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API 0.2%
• CVE-2026-64862 Medium 6.5 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS 0.2%
• CVE-2026-55796 Medium 6.5 Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report 0.3%
• CVE-2026-111389 High 7.7 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation 0.3%
• CVE-2026-108733 Medium 4.3 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation 0.3%
• CVE-2026-108732 Medium 4.3 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount 0.3%
• CVE-2026-54524 High 7.1 Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report 0.5%
• CVE-2026-45081 Medium 6.5 Frappe HR: Permission Bypass in HRMS Leave Details API 0.2%
• CVE-2026-41320 Medium 6.5 Frappe HR has possibility of SQL Injection due to improper field sanitization 0.2%
• CVE-2026-40889 Medium 6.5 Frappe HR has Improper Access Control on Files 0.2%
• CVE-2026-40888 Medium 6.5 Frappe HR vulnerable to Improper Access Control 0.2%