受影响的版本系列
- 16.50 2 个 CVE
- 16.36 2 个 CVE
- 16.35 6 个 CVE
- 16.34 12 个 CVE
- 16.33 23 个 CVE
- 16.32 27 个 CVE
- 16.31 32 个 CVE
- 16.30 36 个 CVE
- 16.27 37 个 CVE
- 16.26 40 个 CVE
- 16.24 44 个 CVE
- 16.23 46 个 CVE
- 16.22 52 个 CVE
- 16.21 57 个 CVE
- 16.18 64 个 CVE
- 16.16 67 个 CVE
- 16.15 69 个 CVE
- 16.14 70 个 CVE
- 16.12 72 个 CVE
- 16.11 74 个 CVE
- 16.10 76 个 CVE
- 16.9 78 个 CVE
- 16.8 79 个 CVE
- 16.6 82 个 CVE
- 16.0 84 个 CVE
- 15.121 18 个 CVE
- 15.120 29 个 CVE
- 15.119 38 个 CVE
- 15.118 43 个 CVE
- 15.116 44 个 CVE
- 15.115 45 个 CVE
- 15.113 48 个 CVE
- 15.112 51 个 CVE
- 15.111 57 个 CVE
- 15.110 59 个 CVE
- 15.108 66 个 CVE
- 15.106 67 个 CVE
- 15.105 71 个 CVE
- 15.104 74 个 CVE
- 15.103 76 个 CVE
- 15.102 77 个 CVE
- 15.101 81 个 CVE
- 15.100 81 个 CVE
- 15.98 83 个 CVE
- 15.89 92 个 CVE
- 15.88 93 个 CVE
- 15.83 94 个 CVE
- 15.76 94 个 CVE
- 15.67 98 个 CVE
- 15.57 104 个 CVE
- 15.55 95 个 CVE
- 15.0 94 个 CVE
- 14.92 93 个 CVE
- 14.89 94 个 CVE
- 14.82 95 个 CVE
- 14.74 95 个 CVE
- 13.30 94 个 CVE
- 13.4 96 个 CVE
- 13.1 95 个 CVE
- 13.0 98 个 CVE
- 12.29 98 个 CVE
- 12.0 97 个 CVE
- 11.1 105 个 CVE
- 11.0 97 个 CVE
- 10.1 99 个 CVE
- 10.0 95 个 CVE
- 9.0 94 个 CVE
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-124316 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-124315 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124314 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 7.1 | — | 2026-11-07 | |
| CVE-2026-124313 | Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc | < 15.121.4 ≥ 16.0.0-beta.1 < 16.36.0 | 5.3 | — | 2026-11-07 | |
| CVE-2026-108373 | ERPNext: Unauthorised access to financial data due to missing validation | * | 6.5 | — | 2026-10-17 | |
| CVE-2026-108374 | ERPNext: Unauthorised status modification due to missing validation | * | 7.7 | — | 2026-10-17 | |
| CVE-2026-109674 | Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation | < 15.98.0 ≥ 16.0.0-beta.1 < 16.6.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109673 | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names | < 15.103.0 ≥ 16.0.0-beta.1 < 16.12.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109671 | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109672 | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data | < 15.118.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109670 | Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109668 | Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109669 | Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109667 | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109665 | Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation | < 15.108.0 ≥ 16.0.0-beta.1 < 16.18.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109666 | Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109664 | Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | < 15.112.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109663 | Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters | < 15.113.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109662 | Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109661 | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data | < 15.116.0 ≥ 16.0.0-beta.1 < 16.27.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109660 | Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109659 | Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data | < 15.113.0 ≥ 16.0.0-beta.1 < 16.24.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109658 | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109657 | Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name | ≥ 16.0.0-beta.1 < 16.27.0 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109656 | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access | < 15.118.2 ≥ 16.0.0-beta.1 < 16.30.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109654 | Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109655 | Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109653 | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109652 | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109651 | Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109650 | Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data | < 15.112.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109648 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109649 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.11.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109647 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109646 | Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation | < 15.106.0 ≥ 16.0.0-beta.1 < 16.16.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109645 | Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109644 | Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data | < 15.119.0 ≥ 16.0.0-beta.1 < 16.31.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109642 | Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109643 | Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data | < 15.111.0 ≥ 16.0.0-beta.1 < 16.22.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109641 | Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109640 | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification | < 16.22.0 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109639 | Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests | < 15.102.0 ≥ 16.0.0-beta.1 < 16.8.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109637 | Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification | < 16.14.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109638 | Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation | < 15.110.0 ≥ 16.0.0-beta.1 < 16.21.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109636 | Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data | < 15.115.0 ≥ 16.0.0-beta.1 < 16.26.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109635 | Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints | < 15.105.0 ≥ 16.0.0-beta.1 < 16.15.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109634 | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 6.9 | — | 2026-10-13 | |
| CVE-2026-109633 | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 8.6 | — | 2026-10-13 | |
| CVE-2026-109631 | Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation | < 15.119.1 ≥ 16.0.0-beta.1 < 16.32.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109632 | Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109629 | Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109630 | Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109628 | Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109626 | Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints | < 16.34.2 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109627 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109625 | Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data | < 15.121.3 ≥ 16.0.0-beta.1 < 16.35.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109624 | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data | < 15.120.0 ≥ 16.0.0-beta.1 < 16.33.0 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109623 | Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization | < 15.121.1 ≥ 16.0.0-beta.1 < 16.34.2 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109622 | Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization | < 15.121.0 ≥ 16.0.0-beta.1 < 16.34.0 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109621 | Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass | < 15.120.0 ≥ 16.0.0-beta.1 < 16.23.0 | 7.1 | — | 2026-10-13 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。