Known Vulnerabilities for Frappe Framework by Frappe
Listed below are 10 of the newest known vulnerabilities associated with "Frappe Framework" by "Frappe".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-114664 json | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_event... | Not Provided | 2026-10-22 | 2026-10-22 |
| CVE-2026-111388 json | Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session ... | Not Provided | 2026-10-16 | 2026-10-16 |
| CVE-2026-109603 json | Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF ... | Not Provided | 2026-10-12 | 2026-10-13 |
| CVE-2026-109601 json | Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of att... | Not Provided | 2026-10-12 | 2026-10-14 |
| CVE-2026-109600 json | Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Doc... | Not Provided | 2026-10-12 | 2026-10-15 |
| CVE-2026-109598 json | Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted se... | Not Provided | 2026-10-12 | 2026-10-13 |
| CVE-2026-82634 json | Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privi... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-66059 json | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes res... | Not Provided | 2026-08-07 | 2026-08-08 |
| CVE-2026-66058 json | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API... | Not Provided | 2026-08-07 | 2026-08-10 |
| CVE-2026-66057 json | Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized cli... | Not Provided | 2026-10-13 | 2026-10-14 |