2026

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoin

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoin

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain e

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a ca

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoin

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain e

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoin

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read fin

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain e

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoin

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain en

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that la

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a to

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart f

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling o

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sendin

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelist

Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content auth

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modu

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to rea

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with ba

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows auth

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db

A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown c

A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/fo

A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the fil

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary co

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to mis

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard p

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printvie

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certai

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permis

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derive

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documen

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text functi

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-s

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to v

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handli

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control o

IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontroll

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled re

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor app