Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,195 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109625 | 7.1 High | Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | Oct 12, 2026 |
| CVE-2026-109624 | 7.1 High | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | Oct 12, 2026 |
| CVE-2026-109623 | 5.3 Medium | Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | Oct 12, 2026 |
| CVE-2026-109622 | 5.3 Medium | Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | Oct 12, 2026 |
| CVE-2026-109621 | 7.1 High | Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | Oct 12, 2026 |
| CVE-2026-109617 | 7.1 High | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints | Oct 12, 2026 |
| CVE-2026-109616 | 7.1 High | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification | Oct 12, 2026 |
| CVE-2026-109615 | 7.1 High | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints | Oct 12, 2026 |
| CVE-2026-109614 | 7.1 High | Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data | Oct 12, 2026 |
| CVE-2026-109613 | 7.1 High | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification | Oct 12, 2026 |
| CVE-2026-109612 | 8.5 High | Frappe ERPNext before 15.120.0 Stored XSS via Report View | Oct 12, 2026 |
| CVE-2026-109611 | 5.3 Medium | Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints | Oct 12, 2026 |
| CVE-2026-109610 | 7.1 High | Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification | Oct 12, 2026 |
| CVE-2026-109609 | 7.1 High | Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation | Oct 12, 2026 |
| CVE-2026-109608 | 8.7 High | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input | Oct 12, 2026 |
| CVE-2026-109604 | 8.5 High | ERPNext before 15.112.0 Stored XSS via Tool View Record Names | Oct 12, 2026 |
| CVE-2026-109603 | 4.8 Medium | Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit | Oct 12, 2026 |
| CVE-2026-109602 | 5.1 Medium | Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters | Oct 12, 2026 |
| CVE-2026-109601 | 7.1 High | Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML | Oct 12, 2026 |
| CVE-2026-109600 | 6.9 Medium | Frappe before 16.31.0 Improper Access Control in Document Follow Notifications | Oct 12, 2026 |
| CVE-2026-109599 | 5.3 Medium | Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification | Oct 12, 2026 |
| CVE-2026-109598 | 5.3 Medium | Frappe before 16.33.0 Broken Authorization via send_sms Endpoint | Oct 12, 2026 |
| CVE-2026-109597 | 5.1 Medium | Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs | Oct 12, 2026 |
| CVE-2026-109596 | 6.7 Medium | Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor | Oct 12, 2026 |
| CVE-2026-109595 | 6.7 Medium | Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver | Oct 12, 2026 |
| CVE-2026-109574 | 6.7 Medium | Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback | Oct 12, 2026 |
| CVE-2026-109573 | 9.2 Critical | phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint | Oct 12, 2026 |
| CVE-2026-109572 | 7.2 High | Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy | Oct 12, 2026 |
| CVE-2025-71432 | 8.6 High | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover | Oct 12, 2026 |
| CVE-2025-71431 | 6.3 Medium | Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters | Oct 12, 2026 |
| CVE-2025-71430 | 5.1 Medium | Frappe before 15.91.1 Stored XSS via Leaderboard User Names | Oct 12, 2026 |
| CVE-2024-58391 | 5.3 Medium | Frappe before 15.4.0 XSS via Printview Parameters | Oct 12, 2026 |
| CVE-2024-58390 | 8.7 High | Frappe before 15.41.0 Privilege Escalation via Document Action | Oct 12, 2026 |
| CVE-2023-54412 | 7.1 High | Frappe before 13.46.3 Improper Access Control for Email Templates | Oct 12, 2026 |
| CVE-2023-54411 | 8.2 High | Frappe before 13.32.0 Weak Authentication via Print View Key | Oct 12, 2026 |
| CVE-2023-54410 | 5.3 Medium | Frappe before 13.22.0 Improper Authorization via Document Rename | Oct 12, 2026 |
| CVE-2023-54409 | 5.9 Medium | Frappe before 13.46.1 XSS via html2text Weak Sanitization | Oct 12, 2026 |
| CVE-2023-54408 | 5.1 Medium | Frappe before 14.31.0 HTML Injection via Weak Escaping | Oct 12, 2026 |
| CVE-2023-54407 | 6.9 Medium | Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks | Oct 12, 2026 |
| CVE-2023-54406 | 6.9 Medium | Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts | Oct 12, 2026 |
| CVE-2026-108935 | 4.8 Medium | Edimax BR-6208AC Port Forwarding formPortFw cross site scripting | Oct 12, 2026 |
| CVE-2026-108934 | 4.8 Medium | Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting | Oct 12, 2026 |
| CVE-2026-102596 | 4.3 Medium | Nango: Production flow RBAC bypass on private flow-read routes | Oct 12, 2026 |
| CVE-2026-44828 | 9.3 Critical | Qexo initialization endpoint can reset setup state and expose stored credentials | Oct 12, 2026 |
| CVE-2026-54459 | 4.3 Medium | FileRise: Missing CSRF enforcement for file creation and share-link creation | Oct 12, 2026 |
| CVE-2026-104140 | 6.1 Medium | QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values | Oct 12, 2026 |
| CVE-2026-108933 | 4.8 Medium | Edimax BR-6208AC formFilter cross site scripting | Oct 12, 2026 |
| CVE-2026-90911 | 7.5 High | Maximo AI Service Denial of Service | Oct 12, 2026 |
| CVE-2026-90912 | 7.5 High | Maximo AI Service Denial of Service | Oct 12, 2026 |
| CVE-2026-90920 | 9.8 Critical | Maximo AI Service Code Injection | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.