https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T20:14:49.597706+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-124316 fkie_cve-2026-124316 2026-11-10T20:14:49.599200+00:00

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.

 https://db.gcve.eu/vuln/ghsa-5wjf-fvgv-583h GHSA-5wjf-fvgv-583h 2026-11-10T20:14:49.599281+00:00

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.