# Frappe HR vulnerabilities Source: https://junglewise.ai/threats/technologies/hr Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/hr.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in Frappe HR: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-64862, was published on 16 October 2026. 2 vulnerabilities in the last four weeks, down 33% on the four before (3). ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 5 - All time: 9 (0 critical, 0 exploited in the wild) ## About Frappe HR Frappe HR is an open-source human resources management module built on the Frappe framework. ## Latest Frappe HR vulnerabilities - [CVE-2026-64862: Frappe HR authorization bypass in PWA API endpoints](https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS report](https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-108733: Frappe HR missing authorization in expire_allocation](https://junglewise.ai/threats/cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-101006: Frappe HR authorization bypass in API functions](https://junglewise.ai/threats/cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this) (medium, CVSS 4.3, published 28 Sep 2026) - [CVE-2026-54524: Frappe HR SQL injection in Salary Payments report filters](https://junglewise.ai/threats/cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters) (info, published 17 Sep 2026) - [CVE-2026-45081: Frappe HR incorrect authorization in Leave Details API](https://junglewise.ai/threats/cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api) (medium, CVSS 6.5, published 27 May 2026) - [CVE-2026-41320: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a…](https://junglewise.ai/threats/cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) - [CVE-2026-40889: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2…](https://junglewise.ai/threats/cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) - [CVE-2026-40888: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an…](https://junglewise.ai/threats/cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) ## Most severe Frappe HR vulnerabilities - [CVE-2026-40889: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2…](https://junglewise.ai/threats/cve-2026-40889-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) - [CVE-2026-40888: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an…](https://junglewise.ai/threats/cve-2026-40888-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) - [CVE-2026-41320: Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a…](https://junglewise.ai/threats/cve-2026-41320-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 21 Apr 2026) - [CVE-2026-64862: Frappe HR authorization bypass in PWA API endpoints](https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS report](https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-45081: Frappe HR incorrect authorization in Leave Details API](https://junglewise.ai/threats/cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api) (medium, CVSS 6.5, published 27 May 2026) - [CVE-2026-108733: Frappe HR missing authorization in expire_allocation](https://junglewise.ai/threats/cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-101006: Frappe HR authorization bypass in API functions](https://junglewise.ai/threats/cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this) (medium, CVSS 4.3, published 28 Sep 2026) - [CVE-2026-54524: Frappe HR SQL injection in Salary Payments report filters](https://junglewise.ai/threats/cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters) (info, published 17 Sep 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 33% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Frappe technologies - [Frappe ERPNext](https://junglewise.ai/threats/technologies/erpnext): 100 vulnerabilities - [Frappe Framework](https://junglewise.ai/threats/technologies/frappe): 49 vulnerabilities - [Frappe Learning](https://junglewise.ai/threats/technologies/learning): 10 vulnerabilities - [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm): 6 vulnerabilities - [Frappe Learning Management System](https://junglewise.ai/threats/technologies/learning-management-system): 5 vulnerabilities - [Frappe Builder](https://junglewise.ai/threats/technologies/frappe-builder): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Frappe HR vulnerabilities", https://junglewise.ai/threats/technologies/hr, 11 November 2026.