ERPNext / Frappe security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for ERPNext / Frappe. Vendor security advisories are linked on this page.
Built for Operators of this product.
36 public records · 0 security-fix timeline events. 0 published in the last 7 days. 30 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 3
- High 6
- Medium 11
- Low 2
2026-08-0522 issues2026-11-02
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- Medium4.3Broken Access Control in File list/report queriesOpen the advisoryOct 23, 2026
- CriticalPossibility of Server Side Template InjectionCheck if you run itEPSS 0.30%Oct 15, 2026
- Critical9.9Remote code execution via path traversalOpen the advisoryOct 15, 2026
- High8.2Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check.Check if you run itEPSS 0.19%Oct 12, 2026
- MediumBlind SQL Injection in frappe.desk.doctype.event.event.get_eventsOpen the advisoryOct 7, 2026
- Medium5.4restrict_ip allowlist bypassed for API key, OAuth, and header-based authenticationOpen the advisoryOct 1, 2026
- HighUnauthorized users can send sms via the APIOpen the advisorySep 28, 2026
- MediumStored XSS in dashboard chartOpen the advisorySep 22, 2026
- CriticalArbitrary file read via an attribute in outgoing email HTMLOpen the advisorySep 16, 2026