Technology · Frappe
Frappe ERPNext vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 100 vulnerabilities in Frappe ERPNext: 4 in the last 7 days and 76 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124316, was published on 7 November 2026. 74 vulnerabilities in the last four weeks, up 3600% on the four before (2).
- Last 7 days
- 4
- Last 90 days
- 76
- Critical, all time
- 5
- Exploited in the wild
- 0
About Frappe ERPNext
ERPNext is an open-source enterprise resource planning system for managing business operations and workflows.
Latest Frappe ERPNext vulnerabilities
- CVE-2026-124316: Frappe ERPNext missing authorization in buying utilitiesmediumCVSS 4.3
- CVE-2026-124315: Frappe ERPNext missing authorization in BOM methodsmediumCVSS 6.5
- CVE-2026-124314: Frappe ERPNext missing authorization in CRM activitiesmediumCVSS 6.5
- CVE-2026-124313: Frappe ERPNext missing authorization in get_linked_paymentsmediumCVSS 4.3
- CVE-2026-108374: ERPNext authorization bypass in status modification endpointshighCVSS 7.7
- CVE-2026-108373: ERPNext authorization bypass in Sales Person-wise Transaction SummarymediumCVSS 6.5
- CVE-2026-109674: Frappe ERPNext SQL injection in endpointsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109673: Frappe ERPNext stored cross-site scripting in dashboards and portalshighCVSS 7.3EPSS 0.2%
- CVE-2026-109672: Frappe ERPNext missing authorization in financial data endpointsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109671: Frappe ERPNext stored cross-site scripting in profile fieldhighCVSS 7.3EPSS 0.2%
- CVE-2026-109670: Frappe ERPNext stored cross-site scripting in item record namesmediumCVSS 5.4EPSS 0.2%
- CVE-2026-109669: Frappe ERPNext missing authorization in record status endpointsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109668: Frappe ERPNext missing authorization in party record endpointsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109667: Frappe ERPNext privilege escalation in record-creation endpointhighCVSS 8.8EPSS 0.3%
- CVE-2026-109666: Frappe ERPNext missing authorization in inventory endpointsmediumCVSS 6.5EPSS 0.2%
- CVE-2026-109665: Frappe ERPNext missing authorization in deactivation endpointsmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109664: Frappe ERPNext missing authorization in record modificationmediumCVSS 4.3EPSS 0.2%
- CVE-2026-109663: Frappe ERPNext SQL injection in endpoint validationmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109662: Frappe ERPNext stored XSS in public portal formmediumCVSS 6.1EPSS 0.2%
- CVE-2026-109661: Frappe ERPNext missing authorization in financial endpointsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109660: Frappe ERPNext authorization bypass in production record endpointsmediumCVSS 6.5EPSS 0.2%
- CVE-2026-109659: Frappe ERPNext missing authorization in financial data endpointsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109658: Frappe ERPNext missing authorization in endpointsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109657: Frappe ERPNext stored cross-site scripting in record namemediumCVSS 5.4EPSS 0.2%
- CVE-2026-109656: Frappe ERPNext missing authorization on item master endpointsmediumCVSS 6.5EPSS 0.3%
Most severe Frappe ERPNext vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-44442: Frappe ERPNext missing authorization in document modification endpointscriticalCVSS 9.9
- CVE-2026-38431: Frappe ERPNext SSTI in Email Template EnginecriticalCVSS 9.8EPSS 0.4%
- CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in AttachmentscriticalCVSS 9.6EPSS 0.4%
- CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generationcriticalCVSS 9.1EPSS 0.3%
- CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…criticalCVSS 9EPSS 0.4%
- CVE-2023-54345: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated…highCVSS 8.8EPSS 0.6%
- CVE-2025-66437: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext…highCVSS 8.8EPSS 0.6%
- CVE-2025-66434: An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext…highCVSS 8.8EPSS 0.6%
- CVE-2025-66438: A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format…highCVSS 8.8EPSS 0.5%
- CVE-2025-66440: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at…highCVSS 8.8EPSS 0.4%
Vulnerabilities per week
74 vulnerabilities in the last four weeks, up 3600% on the four before (2). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 70 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 4 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Frappe ERPNext vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/erpnext)<a href="https://junglewise.ai/threats/technologies/erpnext"><img src="https://junglewise.ai/threats/technologies/erpnext/badge.svg" alt="Frappe ERPNext vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/erpnext.json, and this page as text at https://junglewise.ai/threats/technologies/erpnext.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Frappe ERPNext vulnerabilities", https://junglewise.ai/threats/technologies/erpnext, 12 November 2026.