Erpnext

This hub aggregates every CVE we track for Erpnext, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Erpnext.

• CVE-2026-96672Frappe ERPNext before 16.34.1 Unauthorized Method Invocation6.4Sep 23, 2026
• CVE-2026-94113Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints6.5Sep 20, 2026
• CVE-2026-65822ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter7.6Aug 17, 2026
• CVE-2026-65974ERPNext: Server-Side Template Injection leading to Remote Code Execution9.9Aug 17, 2026
• CVE-2026-72911ERPNext: Possibility of server-side template injection due to missing validation9.9Aug 10, 2026
• CVE-2026-72910ERPNext: Unauthorised modification of master data due to missing validation7.1Aug 10, 2026
• CVE-2026-72909ERPNext: Broken Access Control on certain endpointsAug 10, 2026
• CVE-2026-72908ERPNext: Possibility of SQL injection due to missing validation6.5Aug 10, 2026
• CVE-2026-72907ERPNext: Broken Access Control on certain endpoint6.5Aug 10, 2026
• CVE-2026-72906ERPNext: Unauthorised triggering of automated emails due to missing validation4.3Aug 10, 2026
• CVE-2026-13227ERPNext v16.25.0 - Improper authorization in Prospect opportunities APIAug 4, 2026
• CVE-2026-12895SQL Injection in Frappe's ERPNextJul 29, 2026
• CVE-2026-55242ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix8.8Jul 15, 2026
• CVE-2026-42839ERPNext 16.16.0 - Stored XSS in POS cart item renderingJun 3, 2026
• CVE-2026-42840ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literalsJun 3, 2026