{"schema_version":1,"title":"Frappe HR vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Frappe HR: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-64862, was published on 16 October 2026. 2 vulnerabilities in the last four weeks, down 33% on the four before (3).","url":"https://junglewise.ai/threats/technologies/hr","json_url":"https://junglewise.ai/threats/technologies/hr.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/hr","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":5,"last_365_days":9},"latest":[{"cve":"CVE-2026-64862","cvss":6.5,"slug":"cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR authorization bypass in PWA API endpoints","severity":"medium","exploited":false,"published_at":"2026-10-16T21:19:19.597+00:00","url":"https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-55796","cvss":6.5,"slug":"cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR SQL injection in Salary Payments via ECS report","severity":"medium","exploited":false,"published_at":"2026-10-16T21:19:18.963+00:00","url":"https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-108733","cvss":4.3,"epss":0.0026,"slug":"cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x","title":"Frappe HR missing authorization in expire_allocation","severity":"medium","exploited":false,"published_at":"2026-10-11T13:17:17.49+00:00","url":"https://junglewise.ai/threats/cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x"},{"cve":"CVE-2026-101006","cvss":4.3,"slug":"cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this","title":"Frappe HR authorization bypass in API functions","severity":"medium","exploited":false,"published_at":"2026-09-28T07:17:20.023+00:00","url":"https://junglewise.ai/threats/cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this"},{"cve":"CVE-2026-54524","epss":0.0048,"slug":"cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters","title":"Frappe HR SQL injection in Salary Payments report filters","severity":"info","exploited":false,"published_at":"2026-09-17T19:16:50.673+00:00","url":"https://junglewise.ai/threats/cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters"},{"cve":"CVE-2026-45081","cvss":6.5,"slug":"cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api","title":"Frappe HR incorrect authorization in Leave Details API","severity":"medium","exploited":false,"published_at":"2026-05-27T18:16:24.433+00:00","url":"https://junglewise.ai/threats/cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api"},{"cve":"CVE-2026-41320","cvss":6.5,"epss":0.0022,"slug":"cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:03.797+00:00","url":"https://junglewise.ai/threats/cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-40889","cvss":6.5,"epss":0.0023,"slug":"cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-40888","cvss":6.5,"epss":0.0023,"slug":"cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:02.537+00:00","url":"https://junglewise.ai/threats/cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Frappe ERPNext","slug":"erpnext","vulnerabilities":100,"url":"https://junglewise.ai/threats/technologies/erpnext"},{"name":"Frappe Framework","slug":"frappe","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/frappe"},{"name":"Frappe Learning","slug":"learning","vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/learning"},{"name":"Frappe Crm","slug":"frappe-crm","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/frappe-crm"},{"name":"Frappe Learning Management System","slug":"learning-management-system","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/learning-management-system"},{"name":"Frappe Builder","slug":"frappe-builder","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/frappe-builder"}],"technology":{"hub":true,"name":"Frappe HR","slug":"hr","vendor":{"hub":true,"name":"Frappe","slug":"frappe","url":"https://junglewise.ai/threats/vendors/frappe"},"aliases":["frappe-hr"],"category":"erp-module","homepage":"https://frappehr.com/","repo_url":"https://github.com/frappe/hrms","description":"Frappe HR is an open-source human resources management module built on the Frappe framework.","url":"https://junglewise.ai/threats/technologies/hr"},"most_severe":[{"cve":"CVE-2026-40889","cvss":6.5,"epss":0.0023,"slug":"cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-40888","cvss":6.5,"epss":0.0023,"slug":"cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:02.537+00:00","url":"https://junglewise.ai/threats/cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-41320","cvss":6.5,"epss":0.0022,"slug":"cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a…","severity":"medium","exploited":false,"published_at":"2026-04-21T20:17:03.797+00:00","url":"https://junglewise.ai/threats/cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-64862","cvss":6.5,"slug":"cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR authorization bypass in PWA API endpoints","severity":"medium","exploited":false,"published_at":"2026-10-16T21:19:19.597+00:00","url":"https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-55796","cvss":6.5,"slug":"cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution","title":"Frappe HR SQL injection in Salary Payments via ECS report","severity":"medium","exploited":false,"published_at":"2026-10-16T21:19:18.963+00:00","url":"https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution"},{"cve":"CVE-2026-45081","cvss":6.5,"slug":"cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api","title":"Frappe HR incorrect authorization in Leave Details API","severity":"medium","exploited":false,"published_at":"2026-05-27T18:16:24.433+00:00","url":"https://junglewise.ai/threats/cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api"},{"cve":"CVE-2026-108733","cvss":4.3,"epss":0.0026,"slug":"cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x","title":"Frappe HR missing authorization in expire_allocation","severity":"medium","exploited":false,"published_at":"2026-10-11T13:17:17.49+00:00","url":"https://junglewise.ai/threats/cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x"},{"cve":"CVE-2026-101006","cvss":4.3,"slug":"cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this","title":"Frappe HR authorization bypass in API functions","severity":"medium","exploited":false,"published_at":"2026-09-28T07:17:20.023+00:00","url":"https://junglewise.ai/threats/cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this"},{"cve":"CVE-2026-54524","epss":0.0048,"slug":"cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters","title":"Frappe HR SQL injection in Salary Payments report filters","severity":"info","exploited":false,"published_at":"2026-09-17T19:16:50.673+00:00","url":"https://junglewise.ai/threats/cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters"}],"generated_at":"2026-11-11T03:07:00.183524+00:00"}