makeplane plane vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20254
3. 202656

Newest CVEs

• CVE-2026-111869

  makeplane API Endpoint reliance on untrusted inputs in a security decision

  makeplane · plane

  Medium6.9
• CVE-2026-102980

  Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

  makeplane · plane

  Medium6.5
• CVE-2026-102985

  Plane: Any project member can modify (deactivate) other members' records

  makeplane · plane

  Medium6.5
• CVE-2026-102986

  Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

  makeplane · plane

  High8.1
• CVE-2026-102981

  Plane: Unauthenticated Workspace Invitation Token Leakage

  makeplane · plane

  Medium6.5
• CVE-2026-102982

  Plane: XSS in work item comments

  makeplane · plane

  High8.5
• CVE-2026-102988

  Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

  makeplane · plane

  Medium5.3
• CVE-2026-105641

  Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

  makeplane · plane

  Critical9.8
• CVE-2026-105640

  Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

  makeplane · plane

  Critical9.1
• CVE-2026-105639

  Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

  makeplane · plane

  Critical9.8