Where
-Infinity
0

Trending

Last week
Last month
Last year

Frappe frappeFrappe: TarSlip RCE in Package Import

Risk 72
Severity
8.6
First published (updated )
CVE-2026-55852

Frappe frappeFrappe: Path Traversal via /backups Route

Risk 36
Severity
6.9
First published (updated )
CVE-2026-42219

Frappe frappeFrappe: Arbitrary Attachment Injection via add_attachments and upload_file

Risk 26
Severity
5.3
First published (updated )
CVE-2026-48127

Frappe frappeFrappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

Risk 40
Severity
7.1
First published (updated )
CVE-2026-41482

Frappe frappeFrappe: Unrestricted API access to save_report

Risk 34
Severity
5.3
First published (updated )
CVE-2026-47422
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe frappeFrappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Risk 33
Severity
6.9
First published (updated )
CVE-2026-53568

Frappe frappeFrappe: IDOR in update_onboarding_step

Risk 26
Severity
5.3
First published (updated )
CVE-2026-44976

Frappe frappeFrappe: Missing authorization on reset form tours

Risk 26
Severity
5.3
First published (updated )
CVE-2026-44975

Frappe frappeFrappe: DB Schema Enumeration via Frappe-Authorization-Source

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44206

Frappe frappeFrappe: Insecure Direct Object Reference for email accounts

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44207
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe frappeFrappe: IDOR in `submit_discussion()`

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44208

Frappe frappeFrappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload

Risk 33
Severity
6.9
First published (updated )
CVE-2026-44205

Frappe frappeFrappe has an Arbitrary File Read via Path Traversal in render_include

Risk 47
Severity
8.7
First published (updated )
CVE-2026-39352

Frappe Frappe FrameworkFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters

Risk 34
Severity
4.6
First published (updated )
CVE-2026-3837

Frappe Frappe FrameworkFrappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer

Risk 34
Severity
4.6
First published (updated )
CVE-2026-3673
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe ERPNextSSRF

Risk 66
Severity
9.1
First published (updated )
CVE-2026-31017

Frappe frappeGHSL-2026-012: Unauthorized Data Exposure via REST API Link Expansion in Frappe - CVE-2026-39351

Risk 66
Severity
6.9
First published (updated )
CVE-2026-39351

Frappe frappeFrappe has a SQL injection in bulk_update

Risk 86
Severity
9.3
First published (updated )
CVE-2026-35614

Frappe frappeFrappe Workspace modification and stored XSS due to improper resource ownership checks

Risk 25
Severity
5.4
EPSS
0.03%
First published (updated )
CVE-2026-31879

Frappe frappeFrappe: Possible SSRF by any authenticated user

Risk 18
Severity
5
EPSS
0.03%
First published (updated )
CVE-2026-31878
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

frappeFrappe SQL Injection due to improper field sanitization

Risk 61
Severity
9.8
EPSS
0.07%
First published (updated )
CVE-2026-31877

Frappe frappeFrappe: Possibility of SQL Injection due to improper fieldname sanitization

Risk 56
Severity
8.8
EPSS
0.04%
First published (updated )
CVE-2026-29081

Frappe frappeFrappe: Broken Access Control in DocShare

Risk 35
Severity
7.1
EPSS
0.05%
First published (updated )
CVE-2026-29077

Frappe frappeFrappe: Stored XSS in avatar_macro.html

Risk 31
Severity
7.2
EPSS
0.04%
First published (updated )
CVE-2026-28436

frappeFrappe Affected by XSS and Open Redirect in Sign Up

Risk 27
Severity
6.1
EPSS
0.03%
First published (updated )
CVE-2026-25956
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frappe frappeCertain Frappe requests are vulnerable to Path Traversal

Risk 43
Severity
7.5
First published (updated )
CVE-2025-68953

Frappe frappeFrappe may be vulnerable remote code execution due to server-side template injection

Risk 75
Severity
9.1
First published (updated )
CVE-2025-68929

Frappe Frappe FrameworkXSS, Malicious File Upload

Risk 80
Severity
9.6
First published (updated )
CVE-2025-67289

ERPNext ERPNextXSS

Risk 74
Severity
9
First published (updated )
CVE-2025-65267

pip/frappeFrappe has possibility of SQL injection due to improper validations

Risk 31
Severity
6.6
EPSS
0.04%
First published (updated )
CVE-2025-30217
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203