frappe vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20234
3. 20246
4. 202533
5. 2026220

Newest CVEs

• CVE-2026-124443

  Frappe before 16.35.0 Broken Access Control in File List/Report Queries

  frappe · frappe

  Medium5.3
• CVE-2026-124316

  Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

  frappe · erpnext

  Medium5.3
• CVE-2026-124315

  Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

  frappe · erpnext

  High7.1
• CVE-2026-124314

  Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

  frappe · erpnext

  High7.1
• CVE-2026-124313

  Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc

  frappe · erpnext

  Medium5.3
• CVE-2026-121442

  Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

  frappe · hrms

  Medium5.3
• CVE-2026-61806

  Frappe LMS allows unpublished certificate access

  frappe · lms

  Medium5.3
• CVE-2026-61805

  Frappe LMS: Quiz result manipulation and cross-user submission forgery

  frappe · lms

  Medium5.3
• CVE-2026-61803

  Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

  frappe · lms

  Medium5.3
• CVE-2026-39375

  Frappe LMS has Stored XSS in Course Meta

  frappe · lms

  Medium5.1