# Frappe vulnerabilities Source: https://junglewise.ai/threats/vendors/frappe Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/frappe.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 188 vulnerabilities in Frappe: 5 in the last 7 days and 129 in the last 90 days, 8 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124443, was published on 8 November 2026. 113 vulnerabilities in the last four weeks, up 1156% on the four before (9). 1 critical against 0. 7 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 26 - Last 90 days: 129 - All time: 188 (8 critical, 0 exploited in the wild) ## About Frappe An open-source software company that develops the Frappe Framework and ERPNext. ## Latest Frappe vulnerabilities - [CVE-2026-124443: Frappe Framework broken access control in File list and report queries](https://junglewise.ai/threats/cve-2026-124443-frappe-framework-before-15-121-1-and-16-x-before-16-35-0) (medium, CVSS 4.3, published 8 Nov 2026) - [CVE-2026-124316: Frappe ERPNext missing authorization in buying utilities](https://junglewise.ai/threats/cve-2026-124316-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-124315: Frappe ERPNext missing authorization in BOM methods](https://junglewise.ai/threats/cve-2026-124315-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-124314: Frappe ERPNext missing authorization in CRM activities](https://junglewise.ai/threats/cve-2026-124314-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-124313: Frappe ERPNext missing authorization in get_linked_payments](https://junglewise.ai/threats/cve-2026-124313-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-121442: Frappe HRMS permission bypass in Expense Claim Advances API](https://junglewise.ai/threats/cve-2026-121442-frappe-hrms-before-15-61-0-contains-a-permission-bypass) (medium, CVSS 4.3, published 3 Nov 2026) - [CVE-2026-61806: Frappe Learning Management System unauthorized unpublished certificate access](https://junglewise.ai/threats/cve-2026-61806-frappe-learning-management-system-lms-is-a-learning-system-that) (info, published 30 Oct 2026) - [CVE-2026-61805: Frappe Learning Management System quiz authorization bypass](https://junglewise.ai/threats/cve-2026-61805-frappe-learning-management-system-lms-is-a-learning-system-that) (info, published 30 Oct 2026) - [CVE-2026-61803: Frappe Learning Management System price manipulation in checkout](https://junglewise.ai/threats/cve-2026-61803-frappe-learning-management-system-lms-is-a-learning-system-that) (info, published 30 Oct 2026) - [CVE-2026-39375: Frappe Learning Management System stored XSS in course meta tags](https://junglewise.ai/threats/cve-2026-39375-frappe-learning-management-system-lms-is-a-learning-system-that) (info, published 30 Oct 2026) - [CVE-2026-119145: Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-119144: Frappe Framework server-side template injection in message fields](https://junglewise.ai/threats/cve-2026-119144-frappe-framework-before-15-111-0-and-16-x-before-16-21-0) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-116492: Frappe CRM missing authorization in phone lookup API](https://junglewise.ai/threats/cve-2026-116492-frappe-crm-app-before-1-89-1-contains-a-missing-authorization) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-115720: Frappe Builder server-side request forgery via redirect bypass](https://junglewise.ai/threats/cve-2026-115720-frappe-builder-before-1-36-1-contains-a-server-side-request) (medium, CVSS 5, published 26 Oct 2026) - [CVE-2026-115718: Frappe Builder missing authorization in improve_prompt endpoint](https://junglewise.ai/threats/cve-2026-115718-frappe-builder-versions-1-33-0-before1-36-0-contain-a-missing) (medium, CVSS 4.3, published 26 Oct 2026) - [CVE-2026-115717: Frappe Builder SSRF in convert_to_webp API](https://junglewise.ai/threats/cve-2026-115717-frappe-builder-versions-before-1-36-1-contain-a-server-side) (high, CVSS 7.7, published 26 Oct 2026) - [CVE-2026-114664: Frappe Framework blind SQL injection in get_events method](https://junglewise.ai/threats/cve-2026-114664-frappe-framework-before-16-33-0-contains-a-blind-sql-injection) (high, CVSS 7.1, published 22 Oct 2026) - [CVE-2026-111939: Frappe Helpdesk authorization bypass in ticket creation](https://junglewise.ai/threats/cve-2026-111939-frappe-helpdesk-before-1-26-0-contains-an-authorization-bypass) (medium, CVSS 4.6, published 19 Oct 2026) - [CVE-2026-111938: Frappe CRM missing authorization in call log modification](https://junglewise.ai/threats/cve-2026-111938-frappe-crm-before-1-74-0-contains-a-missing-authorization) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2026-111937: Frappe CRM missing authorization in notifications](https://junglewise.ai/threats/cve-2026-111937-frappe-crm-before-1-81-2-contains-a-missing-authorization) (medium, CVSS 5.4, published 19 Oct 2026) - [CVE-2026-64862: Frappe HR authorization bypass in PWA API endpoints](https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS report](https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-108374: ERPNext authorization bypass in status modification endpoints](https://junglewise.ai/threats/cve-2026-108374-erpnext-is-a-free-and-open-source-enterprise-resource-planning) (high, CVSS 7.7, published 16 Oct 2026) - [CVE-2026-108373: ERPNext authorization bypass in Sales Person-wise Transaction Summary](https://junglewise.ai/threats/cve-2026-108373-erpnext-is-a-free-and-open-source-enterprise-resource-planning) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-111389: Frappe HRMS SQL injection in endpoint validation](https://junglewise.ai/threats/cve-2026-111389-frappe-hrms-14-x-before-14-38-2-15-x-before-15-64-0-and-16-x) (high, CVSS 7.7, published 16 Oct 2026) ## Most severe Frappe vulnerabilities - [CVE-2026-119145: Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-44442: Frappe ERPNext missing authorization in document modification endpoints](https://junglewise.ai/threats/cve-2026-44442-frappe-erpnext-missing-authorization-in-document-modification) (critical, CVSS 9.9, published 13 May 2026) - [CVE-2026-38431: Frappe ERPNext SSTI in Email Template Engine](https://junglewise.ai/threats/cve-2026-38431-frappe-erpnext-ssti-in-email-template-engine) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in Attachments](https://junglewise.ai/threats/cve-2025-67289-frappe-framework-and-erpnext-arbitrary-file-upload-in-attachments) (critical, CVSS 9.6, published 22 Dec 2025) - [CVE-2026-39351: Frappe unrestricted Doctype access via API exploit](https://junglewise.ai/threats/cve-2026-39351-frappe-unrestricted-doctype-access-via-api-exploit) (critical, CVSS 9.1, published 7 Apr 2026) - [CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generation](https://junglewise.ai/threats/cve-2026-31017-frappe-erpnext-and-frappe-framework-ssrf-in-print-format-pdf) (critical, CVSS 9.1, published 8 Apr 2026) - [CVE-2025-68929: Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with…](https://junglewise.ai/threats/cve-2025-68929-frappe-is-a-full-stack-web-application-framework-prior-to) (critical, CVSS 9, published 29 Dec 2025) - [CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…](https://junglewise.ai/threats/cve-2025-65267-in-erpnext-v15-83-2-and-frappe-framework-v15-86-0-improper) (critical, CVSS 9, published 3 Dec 2025) - [CVE-2023-54345: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated…](https://junglewise.ai/threats/cve-2023-54345-frappe-framework-erpnext-13-4-0-contains-a-sandbox-escape) (high, CVSS 8.8, published 5 May 2026) - [CVE-2025-66437: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext…](https://junglewise.ai/threats/cve-2025-66437-an-ssti-server-side-template-injection-vulnerability-exists-in) (high, CVSS 8.8, published 15 Dec 2025) ## Vulnerabilities per week 113 vulnerabilities in the last four weeks, up 1156% on the four before (9). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 5 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 93 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 10 | 1 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Frappe technologies - [Frappe ERPNext](https://junglewise.ai/threats/technologies/erpnext): 100 vulnerabilities - [Frappe Framework](https://junglewise.ai/threats/technologies/frappe): 49 vulnerabilities - [Frappe Learning](https://junglewise.ai/threats/technologies/learning): 10 vulnerabilities - [Frappe HR](https://junglewise.ai/threats/technologies/hr): 9 vulnerabilities - [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm): 6 vulnerabilities - [Frappe Learning Management System](https://junglewise.ai/threats/technologies/learning-management-system): 5 vulnerabilities - [Frappe Builder](https://junglewise.ai/threats/technologies/frappe-builder): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Frappe vulnerabilities", https://junglewise.ai/threats/vendors/frappe, 13 November 2026.