CVE Tools
Track your stack

Erpnext

148 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Erpnext, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Erpnext CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Erpnext CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-096
2025-107
2025-110
2025-129
2026-010
2026-023
2026-031
2026-041
2026-0510
2026-062
2026-072
2026-089
2026-092
2026-1070
2026-114

Severity

How the 148 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical86%
  • High4028%
  • Medium9365%
  • Low21%

Latest CVEs

The 15 most recently published vulnerabilities affecting Erpnext.

  1. CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests4.3
  2. CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities6.5
  3. CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items6.5
  4. CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc4.3
  5. CVE-2026-108373ERPNext: Unauthorised access to financial data due to missing validation6.5
  6. CVE-2026-108374ERPNext: Unauthorised status modification due to missing validation7.7
  7. CVE-2026-109674Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation6.5
  8. CVE-2026-109673Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names7.3
  9. CVE-2026-109671Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages7.3
  10. CVE-2026-109672Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data6.5
  11. CVE-2026-109670Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name5.4
  12. CVE-2026-109668Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints4.3
  13. CVE-2026-109669Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification4.3
  14. CVE-2026-109667Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation8.8
  15. CVE-2026-109665Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation4.3

Product grouping is registry-driven, with AI assist and human review. How it works