erpnext
- Software type
- Enterprise resource planning
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, erpnext recorded 78 security vulnerabilities in the last 90 days, of which 54 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of erpnext and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requestsCVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_itemsCVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activitiesCVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_docCVE-2026-108374ERPNext: Unauthorised status modification due to missing validation| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | Exploitation statusNot confirmed | FixYes | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | Exploitation statusNot confirmed | FixYes | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | Exploitation statusNot confirmed | FixYes | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-108374ERPNext: Unauthorised status modification due to missing validation | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-108373ERPNext: Unauthorised access to financial data due to missing validation | Exploitation statusNot exploited | FixYes | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-109674Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109673Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109672Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109671Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109670Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109669Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109668Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109667Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109666Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109665Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109664Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109663Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109662Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109661Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109660Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109659Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109658Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109657Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109656Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109655Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109654Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109653Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109652Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109651Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109650Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109649Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109648Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109647Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109646Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109645Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109644Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109643Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109642Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109641Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109640Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109639Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109638Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109637Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109636Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109635Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109634Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109633Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109632Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109631Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
99 Results | Page 1 of 2