F
Vendor security profile
frappe
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs143
Critical7
CISA KEV0
Public exploit9
Patch rate%11
Avg. CVSS6.6
12-month vulnerability rate
0
7
0
0
0
4
2
1
0
25
6
91
CVE KEV
CVE severity distribution
143toplam CVE
Critical7 (5%)
High68 (48%)
Medium65 (45%)
Low3 (2%)
Patch and exploitation view
%11
Verified patch
%0
CISA KEV
%6
Public exploit
16Patch available
0Partial
0Workaround
0Vendor: no patch
127Unknown
Latest vulnerabilities
8.7
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview
F
Patch status unknown
5.1
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param.
F
Patch status unknown
5.3
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
F
Patch status unknownEPSS %0
7.1
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
F
Patch status unknownEPSS %0
8.5
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
F
Patch status unknownEPSS %0
7.1
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
F
Patch status unknownEPSS %0
8.5
CVE-2026-109671
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
F
Patch status unknownEPSS %0
5.1
CVE-2026-109670
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
F
Patch status unknownEPSS %0
5.3
CVE-2026-109669
Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
F
Patch status unknownEPSS %0
5.3
CVE-2026-109668
Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
F
Patch status unknownEPSS %0