Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,974All CVEsplus 19,118 rejected
- 407Last 24 hours2,833 in the last 7 days
- 16,806Last 30 days1,544 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 27 | 22 | 1 | 0 | 56 | 62 |
| 2025 | 0 | 1 | 2 | 1 | 0 | 4 | 6 |
| 2024 | 2 | 0 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-111869 | makeplane API Endpoint reliance on untrusted inputs in a security decisionmakeplane · plane | Medium6.9 |
| CVE-2026-102980 | Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scopemakeplane · plane | Medium6.5 |
| CVE-2026-102985 | Plane: Any project member can modify (deactivate) other members' recordsmakeplane · plane | Medium6.5 |
| CVE-2026-102986 | Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/makeplane · plane | High8.1 |
| CVE-2026-102981 | Plane: Unauthenticated Workspace Invitation Token Leakagemakeplane · plane | Medium6.5 |
| CVE-2026-102982 | Plane: XSS in work item commentsmakeplane · plane | High8.5 |
| CVE-2026-102988 | Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)makeplane · plane | Medium5.3 |
| CVE-2026-105641 | Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassmakeplane · plane | Critical9.8 |
| CVE-2026-105640 | Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)makeplane · plane | Critical9.1 |
| CVE-2026-105639 | Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Planemakeplane · plane | Critical9.8 |
| CVE-2026-105638 | Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forcemakeplane · plane | Critical9.1 |
| CVE-2026-105637 | Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)makeplane · plane | Critical9.6 |
| CVE-2026-105636 | Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)makeplane · plane | Critical9.9 |
| CVE-2026-105635 | Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Tokenmakeplane · plane | High7.4 |
| CVE-2026-105634 | Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Rolesmakeplane · plane | High8.1 |
| CVE-2026-105633 | Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scopemakeplane · plane | High7.1 |
| CVE-2026-105632 | Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectsmakeplane · plane | High8.7 |
| CVE-2026-105631 | Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosuremakeplane · plane | High7.5 |
| CVE-2026-105630 | Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)makeplane · plane | High8.7 |
| CVE-2026-105629 | Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookupmakeplane · plane | High7.1 |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpointmakeplane · plane | High7.6 |
| CVE-2026-104979 | Plane: Cross-tenant stored XSS in intake enables account takeovermakeplane · plane | High8.7 |
| CVE-2026-104978 | Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptancemakeplane · plane | High8.2 |
| CVE-2026-104977 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOUmakeplane · plane | High7.7 |
| CVE-2026-104976 | Plane: SSRF in Gitea OAuthmakeplane · plane | High8.7 |
| CVE-2026-104975 | Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpointsmakeplane · plane | High7.1 |
| CVE-2026-104974 | Plane: Disabled User Auto-Reactivation on Loginmakeplane · plane | High8.1 |
| CVE-2026-104973 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Deliverymakeplane · plane | High7.6 |
| CVE-2026-104971 | Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorizationmakeplane · plane | High8.5 |
| CVE-2026-104970 | Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance adminsmakeplane · plane | High8.1 |
| CVE-2026-104969 | Plane: Cross-Tenant Cycle Issue Hijack via IDORmakeplane · plane | Medium6.5 |
| CVE-2026-104968 | Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/makeplane · plane | High8.7 |
| CVE-2026-104967 | Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpointmakeplane · plane | Medium5.4 |
| CVE-2026-104966 | Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspacesmakeplane · plane | High8.7 |
| CVE-2026-104965 | Plane: Cross-Tenant Issue Relation Creation via IDORmakeplane · plane | Medium5.4 |
| CVE-2026-104964 | Plane: Cross-Workspace Project Modification via Unscoped Project Lookupmakeplane · plane | Medium6.8 |
| CVE-2026-104963 | Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace membermakeplane · plane | Medium4.3 |
| CVE-2026-104962 | Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)makeplane · plane | Medium6.5 |
| CVE-2026-104961 | Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner accessmakeplane · plane | Medium5.4 |
| CVE-2026-104960 | Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usersmakeplane · plane | Medium6.5 |
| CVE-2026-104956 | Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)makeplane · plane | Medium5.3 |
| CVE-2026-104955 | Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)makeplane · plane | Medium5.4 |
| CVE-2026-104894 | Plane: Cross-Tenant Module Issue Linking via IDORmakeplane · plane | Medium4.3 |
| CVE-2026-104893 | Plane: Improper validation allows arbitrary modification of API token rate limitsmakeplane · plane | Medium5.4 |
| CVE-2026-104892 | Plane: Plaintext logging of API tokenmakeplane · plane | High8.7 |
| CVE-2026-86174 | Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Boardmakeplane · plane | Medium5.3 |
| CVE-2026-46558 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspacesmakeplane · plane | High8.3 |
| CVE-2026-40102 | Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analyticsmakeplane · plane | Medium6.5 |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetchingmakeplane · plane | High7.7 |
| CVE-2026-27949 | Plane Exposes User Email (PII and part of credential) in GET Parametermakeplane · plane | Low2.0 |