KATALOG PODATNOŚCI

Baza CVE

Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.

Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.

CVE-2026-109658

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data,…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109659

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109648

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109649

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109650

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109652

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context.…

MonitorujOpis źródłowy · EN

CVSS: 8,7
EPSS: 0,31 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109653

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record…

MonitorujOpis źródłowy · EN

CVSS: 8,5
EPSS: 0,21 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109643

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109644

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109645

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,25 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109646

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109647

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109637

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,22 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109638

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109639

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109640

Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records…

MonitorujOpis źródłowy · EN

CVSS: 7,2
EPSS: 0,22 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109632

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109633

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content…

MonitorujOpis źródłowy · EN

CVSS: 8,6
EPSS: 0,25 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109636

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109626

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109627

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,26 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109628

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,22 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109631

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,28 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109617

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,22 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

CVE-2026-109621

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip…

MonitorujOpis źródłowy · EN

CVSS: 7,1
EPSS: 0,27 %
Publikacja: 13 paź 2026
Poprawka: Status poprawki nieustalony

Podatności: CVE, produkt, opis, sygnały zagrożenia, CVSS, EPSS i data publikacji.
CVE / produkt	Sygnały	Oceny	Publikacja
CVE-2026-109658 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109659 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109648 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109649 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries.…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109650 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template…	Monitoruj	CVSS 8,7EPSS 0,31 %	13 paź 2026
CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without…	Monitoruj	CVSS 8,5EPSS 0,21 %	13 paź 2026
CVE-2026-109643 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks.…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109644 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109645 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,25 %	13 paź 2026
CVE-2026-109646 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109647 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109637 Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests…	Monitoruj	CVSS 7,1EPSS 0,22 %	13 paź 2026
CVE-2026-109638 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109639 Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries.…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks.…	Monitoruj	CVSS 7,2EPSS 0,22 %	13 paź 2026
CVE-2026-109632 Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without…	Monitoruj	CVSS 8,6EPSS 0,25 %	13 paź 2026
CVE-2026-109636 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109626 Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109627 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated…	Monitoruj	CVSS 7,1EPSS 0,26 %	13 paź 2026
CVE-2026-109628 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record…	Monitoruj	CVSS 7,1EPSS 0,22 %	13 paź 2026
CVE-2026-109631 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database…	Monitoruj	CVSS 7,1EPSS 0,28 %	13 paź 2026
CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document…	Monitoruj	CVSS 7,1EPSS 0,22 %	13 paź 2026
CVE-2026-109621 Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement.…	Monitoruj	CVSS 7,1EPSS 0,27 %	13 paź 2026

Źródła i pokrycie danych

Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.

Ostatnio zakończone okno publikacji NVD: 4.11.2026, 23:02 UTC – 5.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.

NVD · publikacjeOstatnie przetworzenie zakończone5.11.2026, 04:07 UTC

NVD · aktualizacjeOstatnie przetworzenie zakończone5.11.2026, 04:08 UTC

CISA KEVOstatnie przetworzenie zakończone5.11.2026, 07:15 UTC

FIRST EPSSOstatnie przetworzenie zakończone5.11.2026, 04:08 UTCData modelu znajduje się przy rekordzie.