https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T08:01:21.190170+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111388 fkie_cve-2026-111388 2026-10-17T08:01:21.201146+00:00

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

 https://db.gcve.eu/vuln/ghsa-87cm-fpc4-v76f GHSA-87cm-fpc4-v76f 2026-10-17T08:01:21.201208+00:00

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.