Makeplane - vulnerabilities (CVEs)

60 CVEs in 1 products, 44 in the last 30 days, newest from 2026-10-14.

Products

• Plane - 60 CVEs

Newest CVEs of Makeplane

• CVE-2026-102980 - CVSS 6.5 (medium), 2026-10-14: Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups…
• CVE-2026-102985 - CVSS 6.5 (medium), 2026-10-14: Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role…
• CVE-2026-102986 - CVSS 8.1 (high), 2026-10-14: Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint…
• CVE-2026-102981 - CVSS 6.5 (medium), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to…
• CVE-2026-102982 - CVSS 8.5 (high), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project…
• CVE-2026-102988 - CVSS 5.3 (medium), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by…
• CVE-2026-105641 - CVSS 9.8 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed,…
• CVE-2026-105640 - CVSS 9.1 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth…
• CVE-2026-105639 - CVSS 9.8 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an…
• CVE-2026-105638 - CVSS 9.1 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of…
• CVE-2026-105637 - CVSS 9.6 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using…
• CVE-2026-105636 - CVSS 9.9 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post()…
• CVE-2026-105635 - CVSS 7.4 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses…
• CVE-2026-105634 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user…
• CVE-2026-105633 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the…
• CVE-2026-105632 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in…
• CVE-2026-105631 - CVSS 7.5 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset…
• CVE-2026-105630 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an…
• CVE-2026-105629 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key…
• CVE-2026-105628 - CVSS 7.6 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through…
• CVE-2026-104979 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through…
• CVE-2026-104978 - CVSS 8.2 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows…
• CVE-2026-104977 - CVSS 7.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling…
• CVE-2026-104976 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to…
• CVE-2026-104975 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two…
• CVE-2026-104974 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with…
• CVE-2026-104973 - CVSS 7.6 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in…
• CVE-2026-104971 - CVSS 8.5 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's…
• CVE-2026-104970 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117,…
• CVE-2026-104969 - CVSS 6.5 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that…