CRITICALCVSS v3.1 9.8Vulnerability
CVE-2026-126315
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00553
- Cvss severity
- CRITICAL
- Cvss score
- 9.8
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 9.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-126315
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-13T10:17:37.443
- Last modified
- 2026-11-13T21:17:41.427
- Epss percentile
- 0.46754
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph