CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,443
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product makeplane:plane. Show all products

45 CVEs, showing 1 to 45
CVESeverityTitlePublished
CVE-2026-102980Medium 6.5Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-102985Medium 6.5Plane: Any project member can modify (deactivate) other members' records
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-102986High 8.1Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
Assigned by GitHub_M
Oct 14, 2026
CVE-2026-102981Medium 6.5Plane: Unauthenticated Workspace Invitation Token Leakage
Assigned by GitHub_M
Oct 13, 2026
CVE-2026-102982High 8.5Plane: XSS in work item comments
Assigned by GitHub_M
Oct 13, 2026
CVE-2026-102988Medium 5.3Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
Assigned by GitHub_M
Oct 13, 2026
CVE-2026-105641Critical 9.8Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105640Critical 9.1Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105639Critical 9.8Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105638Critical 9.1Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105637Critical 9.6Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105636Critical 9.9Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105635High 7.4Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105634High 8.1Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105633High 7.1Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105632High 8.7Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105631High 7.5Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105630High 8.7Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105629High 7.1Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105628High 7.6Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104979High 8.7Plane: Cross-tenant stored XSS in intake enables account takeover
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104978High 8.2Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104977High 7.7Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104976High 8.7Plane: SSRF in Gitea OAuth
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104975High 7.1Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104974High 8.1Plane: Disabled User Auto-Reactivation on Login
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104973High 7.6Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104971High 8.5Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104970High 8.1Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104969Medium 6.5Plane: Cross-Tenant Cycle Issue Hijack via IDOR
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104968High 8.7Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104967Medium 5.4Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104966High 8.7Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104965Medium 5.4Plane: Cross-Tenant Issue Relation Creation via IDOR
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104964Medium 6.8Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104963Medium 4.3Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104962Medium 6.5Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104961Medium 5.4Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104960Medium 6.5Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104956Medium 5.3Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104955Medium 5.4Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104894Medium 4.3Plane: Cross-Tenant Module Issue Linking via IDOR
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104893Medium 5.4Plane: Improper validation allows arbitrary modification of API token rate limits
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-104892High 8.7Plane: Plaintext logging of API token
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-86174Medium 4.3Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
Assigned by VulnCheck
Sep 5, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.