Known vulnerabilities in ERPNext - page 5

Vendor: Frappe
Software: ERPNext
Software CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Total vulnerabilities: 90
Public exploits: 0
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ERPNext ERPNext is affected by 90 known vulnerabilities: 4 high, 27 medium, 59 low Critical High Medium Low

Vulnerabilities (90)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142683 - Missing Authorization
CVE-2026-109640
CWE-862 Medium
No
No
16.22.0 15.08.2026 SB2026081377
#VU142682 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-109639
CWE-89 Low
No
No
15.102.0, 16.8.0 15.08.2026 SB2026043025
#VU142679 - Missing Authorization
CVE-2026-109637
CWE-862 Low
No
No
16.14.0 15.08.2026 SB2026043027
#VU142393 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-109649
CWE-89 Low
No
No
15.102.0, 16.11.0 13.08.2026 SB2026043025
#VU142392 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-109648
CWE-89 Low
No
No
15.106.0, 16.16.0 13.08.2026 SB2026043024
#VU142391 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-109647
CWE-89 Low
No
No
15.106.0, 16.16.0 13.08.2026 SB2026043024
#VU142390 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-109646
CWE-89 Low
No
No
15.106.0, 16.16.0 13.08.2026 SB2026043024
#VU128506 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44446
CWE-89 Medium
No
No
15.104.3, 16.14.0 30.04.2026 SB2026043027
#VU128504 - Missing Authorization
CVE-2026-44448
CWE-862 Low
No
No
15.102.0, 16.11.0 30.04.2026 SB2026043025
#VU128503 - Server-Side Request Forgery (SSRF)
CVE-2026-44441
CWE-918 Low
No
No
15.106.0, 16.16.0 30.04.2026 SB2026043024


Showing elements 81 - 100 out of 90