Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how frappe compares to other vendors in security performance

View Risk Score →

Frappe ERPNextSQL Injection in Frappe's ERPNext

Risk 49
Severity
7.1
First published (updated )
CVE-2026-12895

Frappe Frappe LMSFrappe LMS enrollment bypass in paid courses via unrelated batch

Risk 40
Severity
7.1
First published (updated )
CVE-2026-39385

Frappe frappeFrappe: TarSlip RCE in Package Import

Risk 72
Severity
8.6
First published (updated )
CVE-2026-55852

Frappe frappeFrappe: Path Traversal via /backups Route

Risk 36
Severity
6.9
First published (updated )
CVE-2026-42219

Frappe frappeFrappe: Arbitrary Attachment Injection via add_attachments and upload_file

Risk 26
Severity
5.3
First published (updated )
CVE-2026-48127
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe frappeFrappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

Risk 40
Severity
7.1
First published (updated )
CVE-2026-41482

Frappe Frappe FrameworkFrappe: check_safe_sql_query Permits SELECT INTO OUTFILE

Risk 15
Severity
2.3
First published (updated )
CVE-2026-47199

Frappe Frappe FrameworkFrappe: Unauthenticated User Enumeration via reset_password

Risk 33
Severity
6.9
First published (updated )
CVE-2026-58503

Frappe frappeFrappe: Unrestricted API access to save_report

Risk 34
Severity
5.3
First published (updated )
CVE-2026-47422

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering

Risk 34
Severity
4.8
First published (updated )
CVE-2026-50712
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50711

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50710

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering

Risk 34
Severity
4.8
First published (updated )
CVE-2026-50709

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering

Risk 34
Severity
4.8
First published (updated )
CVE-2026-50708

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50705
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50704

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering

Risk 34
Severity
4.8
First published (updated )
CVE-2026-50703

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering

Risk 37
Severity
5.1
First published (updated )
CVE-2026-50701

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50700

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50699
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe Frappe FrameworkFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering

Risk 30
Severity
4.6
First published (updated )
CVE-2026-50698

Frappe frappeFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Risk 33
Severity
6.9
First published (updated )
CVE-2026-53568

Frappe Frappe FrameworkFrappe: Broken Access Control on Private Files

Risk 26
Severity
5.3
First published (updated )
CVE-2026-47182

Frappe frappeFrappe: IDOR in update_onboarding_step

Risk 26
Severity
5.3
First published (updated )
CVE-2026-44976

Frappe frappeFrappe: Missing authorization on reset form tours

Risk 26
Severity
5.3
First published (updated )
CVE-2026-44975
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe frappeFrappe: DB Schema Enumeration via Frappe-Authorization-Source

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44206

Frappe frappeFrappe: Insecure Direct Object Reference for email accounts

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44207

Frappe frappeFrappe: IDOR in `submit_discussion()`

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44208

Frappe frappeFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44205

Frappe Frappe LMSFrappe LMS: HTML injection in user-controlled metadata

Risk 34
Severity
2.1
First published (updated )
CVE-2026-46546
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203