CVE-2026-72911 | Critical | 9.9 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/… |
CVE-2026-72910 | High | 7.1 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc… |
CVE-2026-72909 | | | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpn… |
CVE-2026-72908 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/t… |
CVE-2026-72907 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th… |
CVE-2026-72906 | Medium | 4.3 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/pr… |
CVE-2026-66000 | | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's c… |
CVE-2026-66058 | | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for a… |
CVE-2026-66059 | | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue… |
CVE-2026-49391 | | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews… |
CVE-2026-47765 | | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document p… |
CVE-2026-47194 | | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request H… |
CVE-2026-47185 | | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated use… |
CVE-2026-13227 | | | 2026-08-04 | An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erp… |
CVE-2026-12895 | | | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation us… |
CVE-2026-39385 | | | 2026-07-20 | Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated b… |
CVE-2026-55242 | High | 8.8 | 2026-07-15 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can… |
CVE-2026-58503 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issu… |
CVE-2026-55852 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not su… |
CVE-2026-49394 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public… |
CVE-2026-48127 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-hand… |
CVE-2026-47422 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has si… |
CVE-2026-47199 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potent… |
CVE-2026-42219 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. Thi… |
CVE-2026-41482 | | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resourc… |
CVE-2026-50712 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50711 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50710 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number… |
CVE-2026-50709 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50708 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50705 | | | 2026-06-24 | A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of untrusted input in the Form Dashboar… |
CVE-2026-50704 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50703 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50701 | | | 2026-06-24 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in t… |
CVE-2026-50700 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the… |
CVE-2026-50699 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to Auto Repeat can… |
CVE-2026-50698 | | | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input before… |
CVE-2026-53568 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This i… |
CVE-2026-50026 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized a… |
CVE-2026-47182 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This iss… |
CVE-2026-44976 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been pa… |
CVE-2026-44975 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the syst… |
CVE-2026-44208 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for… |
CVE-2026-44207 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other user… |
CVE-2026-44206 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. Thi… |
CVE-2026-47739 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This iss… |
CVE-2026-44205 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to… |
CVE-2026-41581 | | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has b… |
CVE-2026-46546 | Medium | 5.4 | 2026-06-10 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.53.0, an authenticated user could sup… |
CVE-2026-42840 | | | 2026-06-03 | An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Poi… |
CVE-2026-42839 | | | 2026-06-03 | An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name, description, or image fields of an Item… |
CVE-2026-45081 | Medium | 6.5 | 2026-05-27 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details du… |
CVE-2026-39405 | | | 2026-05-20 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing… |
CVE-2026-39352 | | | 2026-05-20 | Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversa… |
CVE-2026-44448 | Medium | 5.9 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization ch… |
CVE-2026-44447 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted… |
CVE-2026-44446 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through spe… |
CVE-2026-44445 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) refere… |
CVE-2026-44442 | Critical | 9.9 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing… |
CVE-2026-44441 | Medium | 5.0 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoin… |
CVE-2026-44440 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitation of a Pathname to a Restricted Direct… |
CVE-2026-38432 | Medium | 6.1 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email temp… |
CVE-2026-38431 | Critical | 9.8 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject t… |
CVE-2023-54345 | High | 8.8 | 2026-05-05 | Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute… |
CVE-2026-41430 | Medium | 6.1 | 2026-04-24 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on l… |
CVE-2026-41317 | High | 7.5 | 2026-04-24 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.creat… |
CVE-2026-3837 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected docu… |
CVE-2026-3673 | Medium | 5.4 | 2026-04-22 | An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are… |
CVE-2026-41320 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain en… |
CVE-2026-40889 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files… |
CVE-2026-40888 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can acces… |
CVE-2026-39415 | Medium | 4.3 | 2026-04-08 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in… |
CVE-2026-31017 | Critical | 9.1 | 2026-04-08 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplie… |
CVE-2026-39351 | Critical | 9.1 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit. |
CVE-2026-35614 | Critical | 9.8 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.1… |
CVE-2026-34606 | Medium | 6.1 | 2026-04-02 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS… |
CVE-2026-32954 | High | 7.1 | 2026-03-20 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and… |
CVE-2026-31879 | Medium | 5.4 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users c… |
CVE-2026-31878 | Medium | 5.0 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which w… |
CVE-2026-31877 | Critical | 9.8 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL inje… |
CVE-2026-29081 | Medium | 6.5 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafte… |
CVE-2026-29077 | High | 7.1 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could shar… |
CVE-2026-28436 | High | 7.2 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the… |
CVE-2026-27471 | Critical | 9.1 | 2026-02-21 | ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access… |
CVE-2026-26977 | Medium | 5.3 | 2026-02-20 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are abl… |
CVE-2026-26031 | Medium | 5.3 | 2026-02-11 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe… |
CVE-2026-25956 | Medium | 6.1 | 2026-02-10 | Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could l… |
CVE-2025-65924 | Medium | 4.1 | 2026-02-03 | ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScrip… |
CVE-2025-65923 | Medium | 5.4 | 2026-02-03 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Records… |
CVE-2026-23497 | Medium | 5.4 | 2026-01-14 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vulnerabili… |
CVE-2025-68953 | High | 7.5 | 2026-01-05 | Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal… |
CVE-2025-68929 | Critical | 9.0 | 2025-12-29 | Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into… |
CVE-2025-68928 | Medium | 5.4 | 2025-12-29 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, whi… |
CVE-2025-67289 | Critical | 9.6 | 2025-12-22 | An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-66440 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_ent… |
CVE-2025-66439 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_ent… |
CVE-2025-66438 | High | 8.8 | 2025-12-15 | A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frap… |
CVE-2025-66437 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders addres… |
CVE-2025-66436 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders at… |
CVE-2025-66435 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attac… |