Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.Check if you run itEPSS 0.26%Oct 12, 2026
- High7.1Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints.Check if you run itEPSS 0.28%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks.Open the advisoryOct 12, 2026
- Medium5.3Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Check if you run itEPSS 0.19%Oct 12, 2026
- High7.1Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.Check if you run itEPSS 0.27%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization ch…Open the advisoryOct 12, 2026
- High7.1Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role.Check if you run itEPSS 0.26%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization c…Check if you run itEPSS 0.27%Oct 12, 2026
- High8.5Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into…Open the advisoryOct 12, 2026
- High7.1Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.Check if you run itEPSS 0.28%Oct 12, 2026
- High8.7Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.Check if you run itEPSS 0.25%Oct 12, 2026
- High8.5Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into m…Open the advisoryOct 12, 2026
- High7.1Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.Check if you run itEPSS 0.28%Oct 12, 2026
- Medium6.9Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications.Check if you run itEPSS 0.24%Oct 12, 2026
- Medium5.3Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Open the advisoryOct 12, 2026
- Medium6.7Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-…Check if you run itEPSS 0.14%Oct 12, 2026
- Medium6.7Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's…Check if you run itEPSS 0.14%Oct 12, 2026
- Low1.9A weakness has been identified in Edimax BR-6208AC 1.32.Check if you run itEPSS 0.25%Oct 12, 2026
- High8.6Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowi…Check if you run itEPSS 0.27%Oct 12, 2026
- Medium6.3Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using…Check if you run itEPSS 0.25%Oct 12, 2026
- Medium5.1Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without pro…Open the advisoryOct 12, 2026
- High7.1Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest u…Check if you run itEPSS 0.22%Oct 12, 2026
- Medium5.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check.Check if you run itEPSS 0.19%Oct 12, 2026
- Medium6.9Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured…Check if you run itEPSS 0.31%Oct 12, 2026
- Medium6.9Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution wh…Check if you run itEPSS 0.32%Oct 12, 2026