CVE-2026-35614

Description

References

• frappe/frappe security advisory · Vendor Advisory

Weitere Schwachstellen in frappe

• CVE-2026-81731MITTEL 5.4Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspa…
• CVE-2026-3837MITTEL 5.4An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user open…
• CVE-2026-3673MITTEL 5.4An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report v…
• CVE-2026-31017KRITISCH 9.1A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,…
• CVE-2026-39351KRITISCH 9.1Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.