Затронутые ветки версий
- 16.50 CVE: 2
- 16.36 CVE: 2
- 16.35 CVE: 6
- 16.34 CVE: 12
- 16.33 CVE: 23
- 16.32 CVE: 27
- 16.31 CVE: 32
- 16.30 CVE: 36
- 16.27 CVE: 37
- 16.26 CVE: 40
- 16.24 CVE: 44
- 16.23 CVE: 46
- 16.22 CVE: 52
- 16.21 CVE: 57
- 16.18 CVE: 64
- 16.16 CVE: 67
- 16.15 CVE: 69
- 16.14 CVE: 70
- 16.12 CVE: 72
- 16.11 CVE: 74
- 16.10 CVE: 76
- 16.9 CVE: 78
- 16.8 CVE: 79
- 16.6 CVE: 82
- 16.0 CVE: 84
- 15.121 CVE: 18
- 15.120 CVE: 29
- 15.119 CVE: 38
- 15.118 CVE: 43
- 15.116 CVE: 44
- 15.115 CVE: 45
- 15.113 CVE: 48
- 15.112 CVE: 51
- 15.111 CVE: 57
- 15.110 CVE: 59
- 15.108 CVE: 66
- 15.106 CVE: 67
- 15.105 CVE: 71
- 15.104 CVE: 74
- 15.103 CVE: 76
- 15.102 CVE: 77
- 15.101 CVE: 81
- 15.100 CVE: 81
- 15.98 CVE: 83
- 15.89 CVE: 92
- 15.88 CVE: 93
- 15.83 CVE: 94
- 15.76 CVE: 94
- 15.67 CVE: 98
- 15.57 CVE: 104
- 15.55 CVE: 95
- 15.0 CVE: 94
- 14.92 CVE: 93
- 14.89 CVE: 94
- 14.82 CVE: 95
- 14.74 CVE: 95
- 13.30 CVE: 94
- 13.4 CVE: 96
- 13.1 CVE: 95
- 13.0 CVE: 98
- 12.29 CVE: 98
- 12.0 CVE: 97
- 11.1 CVE: 105
- 11.0 CVE: 97
- 10.1 CVE: 99
- 10.0 CVE: 95
- 9.0 CVE: 94
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-124316 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-124315 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124314 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124313 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-108373 | ERPNext: Unauthorised access to financial data due to missing validation | * | 6.5 | — | 2026-10-17 | |
| CVE-2026-108374 | ERPNext: Unauthorised status modification due to missing validation | * | 7.7 | — | 2026-10-17 | |
| CVE-2026-109674 | Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation | < 15.98.0 ≥ 16.0.0-beta.1 < 16.6.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109673 | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names | < 15.103.0 ≥ 16.0.0-beta.1 < 16.12.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109671 | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109672 | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data | < 15.118.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109670 | Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109668 | Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109669 | Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109667 | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109665 | Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation | < 15.108.0 ≥ 16.0.0-beta.1 < 16.18.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109666 | Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109664 | Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | < 15.112.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109663 | Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters | < 15.113.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109662 | Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109661 | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data | < 15.116.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109660 | Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109659 | Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109658 | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109657 | Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name | ≥ 16.0.0-beta.1 < 16.27.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109656 | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access | < 15.118.2 ≥ 16.0.0-beta.1 < 16.30.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109654 | Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109655 | Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109653 | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109652 | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109651 | Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109650 | Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109648 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109649 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.11.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109647 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109646 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109645 | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109644 | Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109642 | Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109643 | Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109641 | Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109640 | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification | < 16.22.0 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109639 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.8.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109637 | Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification | < 16.14.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109638 | Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109636 | Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109635 | Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints | < 15.105.0 ≥ 16.0.0-beta.1 < 16.15.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109634 | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109633 | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.6 | — | 2026-10-13 | |
| CVE-2026-109631 | Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109632 | Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109629 | Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109630 | Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109628 | Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109626 | Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints | < 16.34.2 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109627 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109625 | Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109624 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109623 | Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | < 15.121.1 ≥ 16.0.0-beta.1 < 16.34.2 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109622 | Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109621 | Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | < 15.120.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).