Known vulnerabilities in ERPNext

Vendor: Frappe
Software: ERPNext
Software CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Total vulnerabilities: 87
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ERPNext ERPNext is affected by 87 known vulnerabilities: 4 high, 26 medium, 57 low Critical High Medium Low

Vulnerabilities (87)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151478 - Missing Authorization
CWE-862 Low
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU151477 - Missing Authorization
CWE-862 Medium
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU151476 - Missing Authorization
CWE-862 Medium
No
No
15.121.3, 16.35.0 20.09.2026 SB2026092049
#VU151475 - Missing Authorization
CWE-862 Low
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU151474 - Missing Authorization
CWE-862 Low
No
No
16.34.0 20.09.2026 SB2026092048
#VU151473 - Missing Authorization
CWE-862 Medium
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU151472 - Missing Authorization
CWE-862 Low
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU151469 - Missing Authorization
CVE-2026-94113
CWE-862 Low
No
No
15.121.0, 16.34.0 20.09.2026 SB2026092048
#VU142685 - Missing Authorization
CWE-862 Medium
No
No
15.110.0, 16.21.0 15.08.2026 SB2026081380
#VU142684 - Missing Authorization
CWE-862 Medium
No
No
15.110.0, 16.21.0 15.08.2026 SB2026081380
#VU142681 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
15.110.0, 16.21.0 15.08.2026 SB2026081380
#VU142677 - Missing Authorization
CWE-862 Low
No
No
15.105.0, 16.15.0 15.08.2026 SB2026081533
#VU142408 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
15.110.0, 16.21.0 13.08.2026 SB2026081380
#VU142407 - Missing Authorization
CWE-862 Low
No
No
15.110.0, 16.21.0 13.08.2026 SB2026081380
#VU142406 - Missing Authorization
CWE-862 Low
No
No
15.110.0, 16.21.0 13.08.2026 SB2026081380
#VU142405 - Missing Authorization
CWE-862 Low
No
No
15.110.0, 16.21.0 13.08.2026 SB2026081380
#VU142404 - Missing Authorization
CWE-862 Low
No
No
15.108.0, 16.18.0 13.08.2026 SB2026081379
#VU142399 - Missing Authorization
CWE-862 Low
No
No
15.113.0, 16.24.0 13.08.2026 SB2026081377
#VU142396 - Missing Authorization
CWE-862 Low
No
No
15.118.2, 16.30.0 13.08.2026 SB2026081378
#VU142386 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
15.113.0, 16.24.0 13.08.2026 SB2026081377


Showing elements 1 - 20 out of 87