CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373

The ERPNext Enterprise Resource Planning tool is vulnerable to unauthorized access to financial data in versions prior to 15.118.0 and 16.27.0 . The root cause is a missing authorization check within certain endpoints of the Sales Person-wise Transaction Summary report. Specifically, the system f...

EUVD-2026-103171

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374

The ERPNext enterprise resource planning tool is vulnerable to unauthorised status modification in versions prior to 15.121.0 and 16.34.0 . The root cause is a missing authorization check in certain endpoints used for status modification. A low-privileged authenticated user can bypass required wr...

EUVD-2026-103170

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108374 ERPNext: Unauthorised status modification due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-87862

A flaw was found in curl. When importing HTTP Strict Transport Security HSTS cache records, loading a parent domain entry configured to include subdomains before a longer-lived subdomain entry silently drops the subdomain policy. Consequently, once the parent policy expires, curl fails to upgrade...

CVE-2026-111718

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111707

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111694

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...