makeplane vulnerabilities

62 published CVEs name makeplane among the affected products.

Newest CVEs

CVE-2026-111869
makeplane API Endpoint reliance on untrusted inputs in a security decision
makeplane · plane
Medium6.9
CVE-2026-102980
Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
makeplane · plane
Medium6.5
CVE-2026-102985
Plane: Any project member can modify (deactivate) other members' records
makeplane · plane
Medium6.5
CVE-2026-102986
Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
makeplane · plane
High8.1
CVE-2026-102981
Plane: Unauthenticated Workspace Invitation Token Leakage
makeplane · plane
Medium6.5
CVE-2026-102982
Plane: XSS in work item comments
makeplane · plane
High8.5
CVE-2026-102988
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
makeplane · plane
Medium5.3
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
makeplane · plane
Critical9.8
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
makeplane · plane
Critical9.1
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
makeplane · plane
Critical9.8