frappe
Number 67 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Frappe, frappe
Total vulnerabilities
266
Critical
10
High
59
Known Exploited
0
Exploit available
6
Network, no login needed
21.3%
Of 263 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 220 | 9 | 47 | 156 | 8 | 0 |
| 2025 | 33 | 1 | 9 | 13 | 10 | 0 |
| 2024 | 6 | 0 | 2 | 2 | 1 | 1 |
| 2023 | 4 | 0 | 1 | 3 | 0 | 0 |
| 2022 | 3 | 0 | 0 | 0 | 0 | 3 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| frappe | 92 | 30 |
| erpnext | 91 | 27 |
| lms | 24 | 3 |
| Frappe Framework | 12 | 0 |
| hrms | 11 | 2 |
| ERPNext | 8 | 2 |
| crm | 6 | 1 |
| press | 6 | 0 |
| LMS | 4 | 0 |
| Frappe | 3 | 0 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Missing Authorization | 78 | 12 |
| Cross-Site Scripting | 57 | 9 |
| SQL Injection | 43 | 20 |
| Incorrect Authorization | 13 | 3 |
| Improper Access Control | 10 | 2 |
| Path Traversal | 10 | 7 |
| Information Disclosure | 7 | 2 |
| Server-Side Request Forgery | 6 | 1 |
| Improper Neutralization of Special Elements Used in a Template Engine | 5 | 5 |
| Insecure Direct Object Reference | 4 | 0 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-124443 | Frappe before 16.35.0 Broken Access Control in File List/Report Queries | Medium | 0.2% | |
| CVE-2026-124316 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | Medium | 0.2% | |
| CVE-2026-124315 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | Medium | 0.3% | |
| CVE-2026-124314 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | Medium | 0.3% | |
| CVE-2026-124313 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | Medium | 0.2% | |
| CVE-2026-121442 | Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API | Medium | 0.2% | |
| CVE-2026-61806 | Frappe LMS allows unpublished certificate access | Medium | 0.2% | |
| CVE-2026-61805 | Frappe LMS: Quiz result manipulation and cross-user submission forgery | Medium | 0.2% | |
| CVE-2026-61803 | Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount | Medium | 0.2% | |
| CVE-2026-39375 | Frappe LMS has Stored XSS in Course Meta | Medium | 0.3% |