Vendor
Frappe vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 188 vulnerabilities in Frappe: 5 in the last 7 days and 129 in the last 90 days, 8 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124443, was published on 8 November 2026. 113 vulnerabilities in the last four weeks, up 1156% on the four before (9). 1 critical against 0. 7 technologies have a page of their own.
- Last 7 days
- 5
- Last 90 days
- 129
- Critical, all time
- 8
- Exploited in the wild
- 0
About Frappe
An open-source software company that develops the Frappe Framework and ERPNext.
Frappe technologies
Latest Frappe vulnerabilities
- CVE-2026-124443: Frappe Framework broken access control in File list and report queriesmediumCVSS 4.3
- CVE-2026-124316: Frappe ERPNext missing authorization in buying utilitiesmediumCVSS 4.3
- CVE-2026-124315: Frappe ERPNext missing authorization in BOM methodsmediumCVSS 6.5
- CVE-2026-124314: Frappe ERPNext missing authorization in CRM activitiesmediumCVSS 6.5
- CVE-2026-124313: Frappe ERPNext missing authorization in get_linked_paymentsmediumCVSS 4.3
- CVE-2026-121442: Frappe HRMS permission bypass in Expense Claim Advances APImediumCVSS 4.3
- CVE-2026-61806: Frappe Learning Management System unauthorized unpublished certificate accessinfo
- CVE-2026-61805: Frappe Learning Management System quiz authorization bypassinfo
- CVE-2026-61803: Frappe Learning Management System price manipulation in checkoutinfo
- CVE-2026-39375: Frappe Learning Management System stored XSS in course meta tagsinfo
- CVE-2026-119145: Frappe path traversal in file uploadcriticalCVSS 9.9
- CVE-2026-119144: Frappe Framework server-side template injection in message fieldshighCVSS 8.8
- CVE-2026-116492: Frappe CRM missing authorization in phone lookup APImediumCVSS 6.5
- CVE-2026-115720: Frappe Builder server-side request forgery via redirect bypassmediumCVSS 5
- CVE-2026-115718: Frappe Builder missing authorization in improve_prompt endpointmediumCVSS 4.3
- CVE-2026-115717: Frappe Builder SSRF in convert_to_webp APIhighCVSS 7.7
- CVE-2026-114664: Frappe Framework blind SQL injection in get_events methodhighCVSS 7.1
- CVE-2026-111939: Frappe Helpdesk authorization bypass in ticket creationmediumCVSS 4.6
- CVE-2026-111938: Frappe CRM missing authorization in call log modificationmediumCVSS 4.3
- CVE-2026-111937: Frappe CRM missing authorization in notificationsmediumCVSS 5.4
- CVE-2026-64862: Frappe HR authorization bypass in PWA API endpointsmediumCVSS 6.5
- CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS reportmediumCVSS 6.5
- CVE-2026-108374: ERPNext authorization bypass in status modification endpointshighCVSS 7.7
- CVE-2026-108373: ERPNext authorization bypass in Sales Person-wise Transaction SummarymediumCVSS 6.5
- CVE-2026-111389: Frappe HRMS SQL injection in endpoint validationhighCVSS 7.7EPSS 0.2%
Most severe Frappe vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-119145: Frappe path traversal in file uploadcriticalCVSS 9.9
- CVE-2026-44442: Frappe ERPNext missing authorization in document modification endpointscriticalCVSS 9.9
- CVE-2026-38431: Frappe ERPNext SSTI in Email Template EnginecriticalCVSS 9.8EPSS 0.4%
- CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in AttachmentscriticalCVSS 9.6EPSS 0.4%
- CVE-2026-39351: Frappe unrestricted Doctype access via API exploitcriticalCVSS 9.1EPSS 0.3%
- CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generationcriticalCVSS 9.1EPSS 0.3%
- CVE-2025-68929: Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with…criticalCVSS 9EPSS 0.5%
- CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…criticalCVSS 9EPSS 0.4%
- CVE-2023-54345: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated…highCVSS 8.8EPSS 0.6%
- CVE-2025-66437: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext…highCVSS 8.8EPSS 0.6%
Vulnerabilities per week
113 vulnerabilities in the last four weeks, up 1156% on the four before (9). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 0 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 4 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 3 | 0 | |
| 12 Oct 2026 | 93 | 0 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 10 | 1 | |
| 2 Nov 2026 | 6 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Frappe vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/frappe)<a href="https://junglewise.ai/threats/vendors/frappe"><img src="https://junglewise.ai/threats/vendors/frappe/badge.svg" alt="Frappe vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/frappe.json, and this page as text at https://junglewise.ai/threats/vendors/frappe.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Frappe vulnerabilities", https://junglewise.ai/threats/vendors/frappe, 13 November 2026.