CVE Tools
Track your stack

Frappe

277 CVEs tracked since 2018. Since Sep 2018, none of them reached CISA KEV.

Frappe CVEs per month

Sep 2018 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Frappe CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-0940
2018-102 or fewer
2018-11no snapshot
2018-122 or fewer
2019-01no snapshot
2019-021 or fewer
2019-03no snapshot
2019-04no snapshot
2019-051 or fewer
2019-06no snapshot
2019-072 or fewer
2019-0840
2019-092 or fewer
2019-102 or fewer
2019-112 or fewer
2019-122 or fewer
2020-012 or fewer
2020-022 or fewer
2020-03100
2020-04no snapshot
2020-05no snapshot
2020-062 or fewer
2020-07no snapshot
2020-082 or fewer
2020-091 or fewer
2020-101 or fewer
2020-111 or fewer
2020-1220
2021-012 or fewer
2021-022 or fewer
2021-03no snapshot
2021-042 or fewer
2021-052 or fewer
2021-062 or fewer
2021-072 or fewer
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-122 or fewer
2022-012 or fewer
2022-022 or fewer
2022-033 or fewer
2022-043 or fewer
2022-053 or fewer
2022-0640
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-0990
2025-10150
2025-114 or fewer
2025-12170
2026-015 or fewer
2026-0260
2026-0370
2026-04120
2026-05130
2026-06260
2026-07110
2026-08250
2026-099 or fewer
2026-101120
2026-110

Products

The products that kept showing up in Frappe's monthly top three, with their CVEs summed over those months.

  1. Erpnext13613 months
  2. Frappe8613 months
  3. Learning134 months
  4. Frappe Framework121 month
  5. Lms103 months
  6. Hrms82 months
  7. Frappe Hr31 month
  8. Frappe Framework (Erpnext)11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Frappe.

  1. CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests4.3
  2. CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities6.5
  3. CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items6.5
  4. CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc4.3
  5. CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API4.3
  6. CVE-2026-61806Frappe LMS allows unpublished certificate access—
  7. CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgery—
  8. CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount—
  9. CVE-2026-39375Frappe LMS has Stored XSS in Course Meta—
  10. CVE-2026-119145Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload9.9
  11. CVE-2026-119144Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields8.8
  12. CVE-2026-116492Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API6.5
  13. CVE-2026-115720Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect5.0
  14. CVE-2026-115717Frappe Builder before 1.36.1 SSRF via convert_to_webp7.7
  15. CVE-2026-115718Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt4.3

The record

Peak rank
#14 in Oct 2026
Busiest month shown
Oct 2026, 112 CVEs
Months with a KEV entry
0 since Sep 2018
Monthly snapshots
16 since 2018
Frappe's full record, month by month