Lucene search
K

312 matches found

NVD
NVD
added yesterday5 views

CVE-2026-47739

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0...

6.9CVSS0.00024EPSS
Exploits0References1
NVD
NVD
added yesterday4 views

CVE-2026-41581

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via getbloglist. This issue has been patched in versions 15.106.0 and 16.16.0...

6.9CVSS0.00018EPSS
Exploits0References1
NVD
NVD
added yesterday5 views

CVE-2026-44205

Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0...

6.9CVSS0.00024EPSS
Exploits0References1
Vulnrichment
Vulnrichment
added yesterday4 views

CVE-2026-53568 Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4...

6.9CVSS5.2AI score0.00024EPSS
Exploits0References1
Cvelist
Cvelist
added yesterday14 views

CVE-2026-50026 Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0...

6.9CVSS0.00029EPSS
Exploits0References1
EUVD
EUVD
added yesterday3 views

EUVD-2026-36458

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0...

6.9CVSS5.2AI score0.00029EPSS
Exploits0References1
EUVD
EUVD
added yesterday5 views

EUVD-2026-36495

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4...

5.3CVSS5.2AI score0.00024EPSS
Exploits0References1
Vulnrichment
Vulnrichment
added yesterday4 views

CVE-2026-47182 Frappe: Broken Access Control on Private Files

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4...

5.3CVSS5.2AI score0.00024EPSS
Exploits0References1
Cvelist
Cvelist
added yesterday13 views

CVE-2026-47182 Frappe: Broken Access Control on Private Files

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4...

5.3CVSS0.00024EPSS
Exploits0References1
Cvelist
Cvelist
added yesterday13 views

CVE-2026-44976 Frappe: IDOR in update_onboarding_step

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4...

5.3CVSS0.00018EPSS
Exploits0References1
EUVD
EUVD
added yesterday4 views

EUVD-2026-36493

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4...

5.3CVSS5.2AI score0.00018EPSS
Exploits0References1
CVE
CVE
added yesterday5 views

CVE-2026-44976

CVE-2026-44976 affects the Frappe web framework. The vulnerability is described as an IDOR in the “update_onboarding_step” function, allowing any user to modify any field in any Onboarding Step record prior to version 16.17.4. The issue is explicitly patched in version 16.17.4. The available conn...

5.3CVSS5.3AI score0.00018EPSS
Exploits0References1
Vulnrichment
Vulnrichment
added yesterday3 views

CVE-2026-44976 Frappe: IDOR in update_onboarding_step

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4...

5.3CVSS5.3AI score0.00018EPSS
Exploits0References1
Vulnrichment
Vulnrichment
added yesterday3 views

CVE-2026-44975 Frappe: Missing authorization on reset form tours

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4...

5.3CVSS5.2AI score0.00018EPSS
Exploits0References1
CVE
CVE
added yesterday6 views

CVE-2026-44975

CVE-2026-44975 (Frappe) : The vulnerability affects the Frappe full‑stack web framework prior to versions 15.107.2 and 16.17.4. An authenticated user can reset onboarding for all users due to missing authorization on the reset form tours. This exposes potential impact on user onboarding state, wi...

5.3CVSS5.2AI score0.00018EPSS
Exploits0References1
Cvelist
Cvelist
added yesterday13 views

CVE-2026-44975 Frappe: Missing authorization on reset form tours

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4...

5.3CVSS0.00018EPSS
Exploits0References1
EUVD
EUVD
added yesterday7 views

EUVD-2026-36491

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4...

5.3CVSS5.2AI score0.00018EPSS
Exploits0References1
EUVD
EUVD
added yesterday4 views

EUVD-2026-36490

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

6.9CVSS5.2AI score0.00024EPSS
Exploits0References1
CVE
CVE
added yesterday4 views

CVE-2026-44206

Frappe (full-stack web application framework) contains CVE-2026-44206, where DB Schema Enumeration is possible via a vulnerable endpoint prior to versions 15.107.2 and 16.17.4. The issue has been patched in those versions. The CVSS 4.0 base score is 6.9 (MEDIUM) with network attack vector, low co...

6.9CVSS5.2AI score0.00024EPSS
Exploits0References1
Cvelist
Cvelist
added yesterday12 views

CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

6.9CVSS0.00024EPSS
Exploits0References1
Rows per page
Query Builder