Export limit exceeded: 405142 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found 'ón' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (405142 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-109650 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.
CVE-2026-109649 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
CVE-2026-109648 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.
CVE-2026-109647 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.
CVE-2026-109646 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
CVE-2026-109645 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.
CVE-2026-109644 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.
CVE-2026-109643 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.
CVE-2026-109642 1 Frappe 1 Erpnext 2026-10-12 4.3 Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.
CVE-2026-109641 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.
CVE-2026-109640 1 Frappe 1 Erpnext 2026-10-12 8.1 High
Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.
CVE-2026-109639 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
CVE-2026-109638 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.
CVE-2026-109637 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.
CVE-2026-109636 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.
CVE-2026-109635 1 Frappe 1 Erpnext 2026-10-12 4.3 Medium
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.
CVE-2026-109634 1 Frappe 1 Erpnext 2026-10-12 4.9 Medium
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
CVE-2026-109633 1 Frappe 1 Erpnext 2026-10-12 8.1 High
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.
CVE-2026-109632 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.
CVE-2026-109631 1 Frappe 1 Erpnext 2026-10-12 6.5 Medium
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.