CVE-2026-35614

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulkupdate. This vulnerability is fixed in 16.14.0 and 15.104.0...

CVE-2026-39351

CVE-2026-39351 affects Frappe prior to versions 16.14.0 and 15.104.0, where unrestricted Doctype access via the API is possible. The root cause is not elaborated in the provided documents beyond the unrestricted Doctype access vector. Potential impact includes unauthorized access to Doctype data ...

AZL-6745 CVE-2021-22940 affecting package nodejs for versions less than 16.14.0-1

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...