影響を受けるバージョン系列
- 16.50 CVE 2 件
- 16.36 CVE 2 件
- 16.35 CVE 6 件
- 16.34 CVE 12 件
- 16.33 CVE 23 件
- 16.32 CVE 27 件
- 16.31 CVE 32 件
- 16.30 CVE 36 件
- 16.27 CVE 37 件
- 16.26 CVE 40 件
- 16.24 CVE 44 件
- 16.23 CVE 46 件
- 16.22 CVE 52 件
- 16.21 CVE 57 件
- 16.18 CVE 64 件
- 16.16 CVE 67 件
- 16.15 CVE 69 件
- 16.14 CVE 70 件
- 16.12 CVE 72 件
- 16.11 CVE 74 件
- 16.10 CVE 76 件
- 16.9 CVE 78 件
- 16.8 CVE 79 件
- 16.6 CVE 82 件
- 16.0 CVE 84 件
- 15.121 CVE 18 件
- 15.120 CVE 29 件
- 15.119 CVE 38 件
- 15.118 CVE 43 件
- 15.116 CVE 44 件
- 15.115 CVE 45 件
- 15.113 CVE 48 件
- 15.112 CVE 51 件
- 15.111 CVE 57 件
- 15.110 CVE 59 件
- 15.108 CVE 66 件
- 15.106 CVE 67 件
- 15.105 CVE 71 件
- 15.104 CVE 74 件
- 15.103 CVE 76 件
- 15.102 CVE 77 件
- 15.101 CVE 81 件
- 15.100 CVE 81 件
- 15.98 CVE 83 件
- 15.89 CVE 92 件
- 15.88 CVE 93 件
- 15.83 CVE 94 件
- 15.76 CVE 94 件
- 15.67 CVE 98 件
- 15.57 CVE 104 件
- 15.55 CVE 95 件
- 15.0 CVE 94 件
- 14.92 CVE 93 件
- 14.89 CVE 94 件
- 14.82 CVE 95 件
- 14.74 CVE 95 件
- 13.30 CVE 94 件
- 13.4 CVE 96 件
- 13.1 CVE 95 件
- 13.0 CVE 98 件
- 12.29 CVE 98 件
- 12.0 CVE 97 件
- 11.1 CVE 105 件
- 11.0 CVE 97 件
- 10.1 CVE 99 件
- 10.0 CVE 95 件
- 9.0 CVE 94 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-124316 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-124315 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124314 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124313 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-108373 | ERPNext: Unauthorised access to financial data due to missing validation | * | 6.5 | — | 2026-10-17 | |
| CVE-2026-108374 | ERPNext: Unauthorised status modification due to missing validation | * | 7.7 | — | 2026-10-17 | |
| CVE-2026-109674 | Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation | < 15.98.0 ≥ 16.0.0-beta.1 < 16.6.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109673 | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names | < 15.103.0 ≥ 16.0.0-beta.1 < 16.12.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109671 | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109672 | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data | < 15.118.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109670 | Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109668 | Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109669 | Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109667 | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109665 | Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation | < 15.108.0 ≥ 16.0.0-beta.1 < 16.18.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109666 | Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109664 | Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | < 15.112.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109663 | Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters | < 15.113.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109662 | Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109661 | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data | < 15.116.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109660 | Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109659 | Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109658 | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109657 | Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name | ≥ 16.0.0-beta.1 < 16.27.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109656 | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access | < 15.118.2 ≥ 16.0.0-beta.1 < 16.30.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109654 | Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109655 | Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109653 | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109652 | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109651 | Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109650 | Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109648 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109649 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.11.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109647 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109646 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109645 | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109644 | Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109642 | Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109643 | Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109641 | Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109640 | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification | < 16.22.0 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109639 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.8.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109637 | Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification | < 16.14.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109638 | Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109636 | Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109635 | Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints | < 15.105.0 ≥ 16.0.0-beta.1 < 16.15.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109634 | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109633 | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.6 | — | 2026-10-13 | |
| CVE-2026-109631 | Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109632 | Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109629 | Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109630 | Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109628 | Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109626 | Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints | < 16.34.2 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109627 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109625 | Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109624 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109623 | Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | < 15.121.1 ≥ 16.0.0-beta.1 < 16.34.2 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109622 | Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109621 | Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | < 15.120.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。