Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Check if you run itEPSS 0.20%Oct 12, 2026
- Medium6.9Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks.Check if you run itEPSS 0.32%Oct 12, 2026
- High7.2Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper aut…Check if you run itEPSS 0.22%Oct 12, 2026
- High7.1Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role.Check if you run itEPSS 0.22%Oct 12, 2026
- High7.1Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that t…Check if you run itEPSS 0.19%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Check if you run itEPSS 0.26%Oct 12, 2026
- High7.1Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to…Check if you run itEPSS 0.28%Oct 12, 2026
- Medium5.3Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.Check if you run itEPSS 0.20%Oct 12, 2026
- High7.1Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.Check if you run itEPSS 0.26%Oct 12, 2026
- High7.1Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints.Check if you run itEPSS 0.28%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Check if you run itEPSS 0.19%Oct 12, 2026
- High7.1Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.Check if you run itEPSS 0.27%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization ch…Check if you run itEPSS 0.22%Oct 12, 2026
- High7.1Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role.Check if you run itEPSS 0.26%Oct 12, 2026
- High7.1Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization c…Check if you run itEPSS 0.27%Oct 12, 2026
- High8.5Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into…Check if you run itEPSS 0.21%Oct 12, 2026
- High7.1Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.Check if you run itEPSS 0.28%Oct 12, 2026
- High8.7Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.Check if you run itEPSS 0.25%Oct 12, 2026
- High8.5Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into m…Check if you run itEPSS 0.21%Oct 12, 2026
- High7.1Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML.Check if you run itEPSS 0.28%Oct 12, 2026
- Medium6.9Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications.Check if you run itEPSS 0.24%Oct 12, 2026
- Medium5.3Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Check if you run itEPSS 0.19%Oct 12, 2026
- Medium6.7Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-…Check if you run itEPSS 0.14%Oct 12, 2026
Sort