https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T11:33:38.391649+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-66057 fkie_cve-2026-66057 2026-10-17T11:33:38.399707+00:00

Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.