Login Request a demo
MA
Vendor
makeplane
1 product with CVEs on record
48
CVEs
0
On KEV
44
New 30D
Products
PL
plane
makeplane
9.9
48 CVEs0 on KEV44 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-102980
PL
plane
makeplane
6.5
0%
Oct 14Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
CVE-2026-102985
PL
plane
makeplane
6.5
0%
Oct 14Plane: Any project member can modify (deactivate) other members' records
CVE-2026-102986
PL
plane
makeplane
8.1
1%
Oct 14Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
CVE-2026-102981
PL
plane
makeplane
6.5
0%
Oct 13Plane: Unauthenticated Workspace Invitation Token Leakage
CVE-2026-102982
PL
plane
makeplane
8.5
0%
Oct 13Plane: XSS in work item comments
CVE-2026-102988
PL
plane
makeplane
5.3
0%
Oct 13Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
CVE-2026-105641
PL
plane
makeplane
9.8
0%
Oct 5Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
CVE-2026-105640
PL
plane
makeplane
9.1
0%
Oct 5Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105639
PL
plane
makeplane
9.8
0%
Oct 5Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
CVE-2026-105638
PL
plane
makeplane
9.1
0%
Oct 5Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
CVE-2026-105637
PL
plane
makeplane
9.6
0%
Oct 5Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
CVE-2026-105636
PL
plane
makeplane
9.9
0%
Oct 5Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105635
PL
plane
makeplane
7.4
0%
Oct 5Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
CVE-2026-105634
PL
plane
makeplane
8.1
0%
Oct 5Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-105633
PL
plane
makeplane
7.1
0%
Oct 5Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
CVE-2026-105632
PL
plane
makeplane
8.7
0%
Oct 5Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
CVE-2026-105631
PL
plane
makeplane
7.5
0%
Oct 5Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
CVE-2026-105630
PL
plane
makeplane
8.7
0%
Oct 5Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
CVE-2026-105629
PL
plane
makeplane
7.1
0%
Oct 5Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
CVE-2026-105628
PL
plane
makeplane
7.6
0%
Oct 5Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
CVE-2026-104979
PL
plane
makeplane
8.7
0%
Oct 5Plane: Cross-tenant stored XSS in intake enables account takeover
CVE-2026-104978
PL
plane
makeplane
8.2
0%
Oct 5Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
CVE-2026-104977
PL
plane
makeplane
7.7
0%
Oct 5Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
CVE-2026-104976
PL
plane
makeplane
8.7
0%
Oct 5Plane: SSRF in Gitea OAuth
CVE-2026-104975
PL
plane
makeplane
7.1
0%
Oct 5Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
CVE-2026-104974
PL
plane
makeplane
8.1
1%
Oct 5Plane: Disabled User Auto-Reactivation on Login
CVE-2026-104973
PL
plane
makeplane
7.6
0%
Oct 5Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-104971
PL
plane
makeplane
8.5
0%
Oct 5Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
CVE-2026-104970
PL
plane
makeplane
8.1
0%
Oct 5Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins
CVE-2026-104969
PL
plane
makeplane
6.5
0%
Oct 5Plane: Cross-Tenant Cycle Issue Hijack via IDOR
CVE-2026-104968
PL
plane
makeplane
8.7
0%
Oct 5Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
CVE-2026-104967
PL
plane
makeplane
5.4
0%
Oct 5Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
CVE-2026-104966
PL
plane
makeplane
8.7
0%
Oct 5Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
CVE-2026-104965
PL
plane
makeplane
5.4
0%
Oct 5Plane: Cross-Tenant Issue Relation Creation via IDOR
CVE-2026-104964
PL
plane
makeplane
6.8
0%
Oct 5Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
CVE-2026-104963
PL
plane
makeplane
4.3
0%
Oct 5Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
CVE-2026-104962
PL
plane
makeplane
6.5
0%
Oct 5Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
CVE-2026-104961
PL
plane
makeplane
5.4
0%
Oct 5Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
CVE-2026-104960
PL
plane
makeplane
6.5
0%
Oct 5Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
CVE-2026-104956
PL
plane
makeplane
5.3
0%
Oct 5Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
CVE-2026-104955
PL
plane
makeplane
5.4
0%
Oct 5Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
CVE-2026-104894
PL
plane
makeplane
4.3
0%
Oct 5Plane: Cross-Tenant Module Issue Linking via IDOR
CVE-2026-104893
PL
plane
makeplane
5.4
0%
Oct 5Plane: Improper validation allows arbitrary modification of API token rate limits
CVE-2026-104892
PL
plane
makeplane
8.7
0%
Oct 5Plane: Plaintext logging of API token
CVE-2026-86174
PL
plane
makeplane
4.3
0%
Sep 5Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
CVE-2026-46558
PL
plane
makeplane
8.3
0%
Jun 10Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
CVE-2026-40102
PL
plane
makeplane
6.5
0%
May 20Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics
CVE-2026-39843
PL
plane
makeplane
7.7
0%
Apr 9Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
CVE-2025-21616
PL
plane
makeplane
5.4
0%
Jan 6Plane has a Cross-site scripting (XSS) via SVG image upload