CVE-2026-35614

Frappe framework (full‑stack web app) contains a SQL injection in bulk_update prior to 16.14.0 and 15.104.0. The issue is fixed in 16.14.0 and 15.104.0. Patching affected installations to these versions or newer is recommended. The CVSS details in the record indicate high impact to confidentialit...

EUVD-2026-19792

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulkupdate. This vulnerability is fixed in 16.14.0 and 15.104.0...