Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109660 | medium | 6.5 | No | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations t... | 2026-10-18 |
| CVE-2026-109655 | medium | 6.5 | No | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |
| CVE-2026-109650 | medium | 6.5 | No | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |
| CVE-2026-109645 | medium | 6.5 | No | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |
| CVE-2026-109635 | medium | 4.3 | No | Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints... | 2026-10-18 |
| CVE-2026-109630 | medium | 4.3 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-18 |
| CVE-2026-109625 | medium | 6.5 | No | Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |
| CVE-2026-109617 | high | 7.1 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |
| CVE-2026-109612 | high | 7.3 | No | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolat... | 2026-10-18 |
| CVE-2026-109604 | high | 7.3 | No | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates... | 2026-10-18 |
| CVE-2026-109599 | medium | 4.3 | No | Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce pro... | 2026-10-18 |
| CVE-2026-109326 | high | 7.5 | No | Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .g... | 2026-10-18 |
| CVE-2026-109321 | critical | 9.1 | No | Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . usern... | 2026-10-18 |
| CVE-2026-109186 | high | 8.8 | No | jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrit... | 2026-10-18 |
| CVE-2026-109181 | medium | 4.3 | No | jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data... | 2026-10-18 |
| CVE-2026-108950 | medium | 5.3 | No | Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthe... | 2026-10-18 |
| CVE-2026-108891 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows an... | 2026-10-18 |
| CVE-2026-108884 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any au... | 2026-10-18 |
| CVE-2026-108879 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users... | 2026-10-18 |
| CVE-2026-108874 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department hea... | 2026-10-18 |