frappe vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 2026200
3. 202638
4. 20268
5. 202612

Newest CVEs

• CVE-2026-121442

  Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

  frappe · hrms

  Medium5.3
• CVE-2026-61806

  Frappe LMS allows unpublished certificate access

  frappe · lms

  Medium5.3
• CVE-2026-61805

  Frappe LMS: Quiz result manipulation and cross-user submission forgery

  frappe · lms

  Medium5.3
• CVE-2026-61803

  Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

  frappe · lms

  Medium5.3
• CVE-2026-39375

  Frappe LMS has Stored XSS in Course Meta

  frappe · lms

  Medium5.1
• CVE-2026-119145

  Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

  frappe · frappe

  Critical9.4
• CVE-2026-119144

  Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

  frappe · frappe

  High8.7
• CVE-2026-116492

  Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

  frappe · crm

  High7.1
• CVE-2026-115720

  Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

  frappe · builder

  Medium5.3
• CVE-2026-115717

  Frappe Builder before 1.36.1 SSRF via convert_to_webp

  frappe · builder

  Medium6.3