CVE-2026-81731中 5.4Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspa…
CVE-2026-3837中 5.4An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user open…
CVE-2026-3673中 5.4An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report v…
CVE-2026-31017緊急 9.1A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1,…
CVE-2026-39351緊急 9.1Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.