Login Request a demo
PL
Product
plane
by makeplane · last CVE Oct 14, 2026
51
CVEs
0
On KEV
9.9
Max CVSS
44
New 30D
Vulnerabilities51In the news0Timeline
Severity mix
Critical 6High 25Medium 20Low 0
Severity
All severities51Critical6High25Medium20Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add plane to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105636
9.9
0%
Oct 5
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
Affected: < 1.4.0
CVE-2026-105641
9.8
0%
Oct 5
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
Affected: < 1.4.0
CVE-2026-105639
9.8
0%
Oct 5
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
Affected: < 1.4.0
CVE-2026-105637
9.6
0%
Oct 5
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
Affected: < 1.4.0
CVE-2026-105640
9.1
0%
Oct 5
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Affected: < 1.4.0
CVE-2026-105638
9.1
0%
Oct 5
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
Affected: < 1.4.0
Showing 6