Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,195 vulnerabilities match.

CVESeveritySummary
CVE-2026-1096755.3 MediumFrappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
CVE-2026-1096747.1 HighFrappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
CVE-2026-1096738.5 HighFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
CVE-2026-1096727.1 HighFrappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
CVE-2026-1096718.5 HighFrappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
CVE-2026-1096705.1 MediumFrappe ERPNext before 15.110.0 Stored XSS via Item Record Name
CVE-2026-1096695.3 MediumFrappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
CVE-2026-1096685.3 MediumFrappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
CVE-2026-1096678.7 HighFrappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
CVE-2026-1096667.1 HighFrappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
CVE-2026-1096655.3 MediumFrappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
CVE-2026-1096645.3 MediumFrappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
CVE-2026-1096637.1 HighFrappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
CVE-2026-1096625.3 MediumFrappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
CVE-2026-1096617.1 HighFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
CVE-2026-1096607.1 HighFrappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
CVE-2026-1096597.1 HighFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
CVE-2026-1096587.1 HighFrappe ERPNext before 15.115.0 Missing Authorization on Endpoints
CVE-2026-1096575.1 MediumFrappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
CVE-2026-1096567.1 HighFrappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
CVE-2026-1096557.1 HighFrappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
CVE-2026-1096545.3 MediumFrappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
CVE-2026-1096538.5 HighFrappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
CVE-2026-1096528.7 HighFrappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
CVE-2026-1096515.3 MediumFrappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
CVE-2026-1096507.1 HighFrappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
CVE-2026-1096497.1 HighFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-1096487.1 HighFrappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
CVE-2026-1096477.1 HighFrappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-1096467.1 HighFrappe ERPNext before 15.106.0 SQL Injection via Missing Validation
CVE-2026-1096457.1 HighFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
CVE-2026-1096447.1 HighFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
CVE-2026-1096437.1 HighFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
CVE-2026-1096425.3 MediumFrappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
CVE-2026-1096416.9 MediumFrappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
CVE-2026-1096407.2 HighFrappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
CVE-2026-1096397.1 HighFrappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
CVE-2026-1096387.1 HighFrappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
CVE-2026-1096377.1 HighFrappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
CVE-2026-1096367.1 HighFrappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
CVE-2026-1096355.3 MediumFrappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
CVE-2026-1096346.9 MediumFrappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
CVE-2026-1096338.6 HighFrappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
CVE-2026-1096327.1 HighFrappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
CVE-2026-1096317.1 HighFrappe ERPNext before 15.119.1 SQL Injection via Missing Validation
CVE-2026-1096305.3 MediumFrappe ERPNext before 15.121.0 Missing Authorization in Endpoints
CVE-2026-1096295.3 MediumFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
CVE-2026-1096287.1 HighFrappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
CVE-2026-1096277.1 HighFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
CVE-2026-1096267.1 HighFrappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.