Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: frappe erpnext 15.120.0, 16.33.0 Clear all filters
TI-2026-71386 CVE-2026-109627 · GHSA-hmfm-jfq6-xhcw

Missing authorization in Frappe ERPNext exposes financial data

Priority LOW 31

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.120.0, 16.33.0 CWE-862
TI-2026-71383 CVE-2026-109624 · GHSA-wf55-4fw8-w767

Missing authorization in Frappe ERPNext exposes personal data

Priority LOW 31

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.120.0, 16.33.0 CWE-862
TI-2026-71374 CVE-2026-109612 · GHSA-vv7g-r4vw-8r7p

Stored cross-site scripting in Frappe ERPNext report view

Priority LOW 38

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00207 Published 2026-10-12 Fixed in 15.120.0, 16.33.0 CWE-79