Betroffene Versionslinien
- 16.50 2 CVEs
- 16.36 2 CVEs
- 16.35 6 CVEs
- 16.34 12 CVEs
- 16.33 23 CVEs
- 16.32 27 CVEs
- 16.31 32 CVEs
- 16.30 36 CVEs
- 16.27 37 CVEs
- 16.26 40 CVEs
- 16.24 44 CVEs
- 16.23 46 CVEs
- 16.22 52 CVEs
- 16.21 57 CVEs
- 16.18 64 CVEs
- 16.16 67 CVEs
- 16.15 69 CVEs
- 16.14 70 CVEs
- 16.12 72 CVEs
- 16.11 74 CVEs
- 16.10 76 CVEs
- 16.9 78 CVEs
- 16.8 79 CVEs
- 16.6 82 CVEs
- 16.0 84 CVEs
- 15.121 18 CVEs
- 15.120 29 CVEs
- 15.119 38 CVEs
- 15.118 43 CVEs
- 15.116 44 CVEs
- 15.115 45 CVEs
- 15.113 48 CVEs
- 15.112 51 CVEs
- 15.111 57 CVEs
- 15.110 59 CVEs
- 15.108 66 CVEs
- 15.106 67 CVEs
- 15.105 71 CVEs
- 15.104 74 CVEs
- 15.103 76 CVEs
- 15.102 77 CVEs
- 15.101 81 CVEs
- 15.100 81 CVEs
- 15.98 83 CVEs
- 15.89 92 CVEs
- 15.88 93 CVEs
- 15.83 94 CVEs
- 15.76 94 CVEs
- 15.67 98 CVEs
- 15.57 104 CVEs
- 15.55 95 CVEs
- 15.0 94 CVEs
- 14.92 93 CVEs
- 14.89 94 CVEs
- 14.82 95 CVEs
- 14.74 95 CVEs
- 13.30 94 CVEs
- 13.4 96 CVEs
- 13.1 95 CVEs
- 13.0 98 CVEs
- 12.29 98 CVEs
- 12.0 97 CVEs
- 11.1 105 CVEs
- 11.0 97 CVEs
- 10.1 99 CVEs
- 10.0 95 CVEs
- 9.0 94 CVEs
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-124316 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-124315 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124314 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124313 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-108373 | ERPNext: Unauthorised access to financial data due to missing validation | * | 6.5 | — | 2026-10-17 | |
| CVE-2026-108374 | ERPNext: Unauthorised status modification due to missing validation | * | 7.7 | — | 2026-10-17 | |
| CVE-2026-109674 | Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation | < 15.98.0 ≥ 16.0.0-beta.1 < 16.6.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109673 | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names | < 15.103.0 ≥ 16.0.0-beta.1 < 16.12.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109671 | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109672 | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data | < 15.118.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109670 | Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109668 | Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109669 | Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109667 | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109665 | Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation | < 15.108.0 ≥ 16.0.0-beta.1 < 16.18.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109666 | Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109664 | Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | < 15.112.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109663 | Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters | < 15.113.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109662 | Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109661 | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data | < 15.116.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109660 | Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109659 | Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109658 | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109657 | Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name | ≥ 16.0.0-beta.1 < 16.27.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109656 | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access | < 15.118.2 ≥ 16.0.0-beta.1 < 16.30.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109654 | Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109655 | Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109653 | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109652 | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109651 | Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109650 | Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109648 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109649 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.11.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109647 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109646 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109645 | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109644 | Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109642 | Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109643 | Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109641 | Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109640 | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification | < 16.22.0 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109639 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.8.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109637 | Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification | < 16.14.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109638 | Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109636 | Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109635 | Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints | < 15.105.0 ≥ 16.0.0-beta.1 < 16.15.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109634 | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109633 | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.6 | — | 2026-10-13 | |
| CVE-2026-109631 | Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109632 | Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109629 | Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109630 | Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109628 | Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109626 | Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints | < 16.34.2 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109627 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109625 | Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109624 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109623 | Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | < 15.121.1 ≥ 16.0.0-beta.1 < 16.34.2 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109622 | Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109621 | Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | < 15.120.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).