makeplane

Records66All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high31CVSS 7.0–8.9

Exploited now

makeplane records in CISA KEV

No makeplane vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Plane 16 records HIGH

Records

66 records

TI-2026-67866 CVE-2026-105641

Hardcoded secret keys in Plane community deployments

HIGH 82

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0046 Published 2026-10-05 Fixed in 1.4.0 CWE-798

TI-2026-67865 CVE-2026-105640

Account takeover in Plane via unverified OAuth email matching

HIGH 80

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00384 Published 2026-10-05 Fixed in 1.4.0 CWE-287

TI-2026-67863 CVE-2026-105638

Plane magic-code login lacks rate limiting, allowing OTP brute force

HIGH 80

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00384 Published 2026-10-05 Fixed in 1.4.0 CWE-307

TI-2024-32097 CVE-2024-47830

Plane allows server side request forgery via /_next/image endpoint

HIGH 79

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00573 Published 2024-10-11 Fixed in 0.23.0 CWE-918

TI-2026-67862 CVE-2026-105637

Cross-project asset hijacking in Plane allows file takeover

HIGH 76

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00319 Published 2026-10-05 Fixed in 1.4.0 CWE-639

TI-2026-67861 CVE-2026-105636

Server-side request forgery in Plane webhook delivery via redirects

HIGH 76

Plane is an open-source project management tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00427 Published 2026-10-05 Fixed in 1.4.0 CWE-918

TI-2026-67857 CVE-2026-105632

Broken access control in Plane lets members self-join private projects

HIGH 73

Plane is an open-source project management tool.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-05 Fixed in 1.4.0 CWE-284

TI-2026-67855 CVE-2026-105630

Stored cross-site scripting in Plane via SVG attachments

HIGH 73

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00214 Published 2026-10-05 Fixed in 1.4.0 CWE-434

TI-2026-67848 CVE-2026-104979

Cross-tenant stored XSS in Plane intake enables account takeover

HIGH 73

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00359 Published 2026-10-05 Fixed in 1.4.0 CWE-79

TI-2026-67771 CVE-2026-104968

Missing authorization in Plane exposes workspace member data

HIGH 73

Plane is an open-source project management tool.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-05 Fixed in 1.4.0 CWE-862

TI-2026-71830 CVE-2026-102982

Cross-site scripting in Plane work item comments

HIGH 72

Plane is an open-source project management tool.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00353 Published 2026-10-13 Fixed in 1.4.0 CWE-79

TI-2026-67847 CVE-2026-104978

Plane project invitations can be hijacked through the join flow

HIGH 71

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00364 Published 2026-10-05 Fixed in 1.4.0 CWE-863

TI-2026-34237 CVE-2026-46558

Authorization bypass in makeplane plane

HIGH 71

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00286 Published 2026-06-10 Fixed in 1.3.1 CWE-639

TI-2026-76080 CVE-2026-111869 · GHSA-frrj-xjh4-92p7

Untrusted X-Forwarded-For input used in makeplane Plane API

HIGH 70

A vulnerability was identified in makeplane plane up to 1.4.2.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00526 Published 2026-10-18 No fix listed CWE-20

TI-2026-67843 CVE-2026-104974

Disabled Plane users can log in and reactivate their accounts

HIGH 70

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00503 Published 2026-10-05 Fixed in 1.4.0 CWE-284

TI-2026-67779 CVE-2026-104971

Plane flaws let users reach assets in other workspaces

HIGH 70

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00349 Published 2026-10-05 Fixed in 1.4.0 CWE-639

TI-2026-74449 CVE-2026-102986

Authorization bypass in Plane lets users upload and delete assets

HIGH 68

Plane is an open-source project management tool.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00513 Published 2026-10-14 Fixed in 1.4.0 CWE-639

TI-2026-67860 CVE-2026-105635

Plane exposes project invitation details to unauthenticated users

HIGH 68

Plane is an open-source project management tool.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00446 Published 2026-10-05 Fixed in 1.4.0 CWE-200

TI-2025-38906 CVE-2025-62716

Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter

HIGH 68

Plane is open-source project management software.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00319 Published 2025-10-24 Fixed in 1.1.0 CWE-601

TI-2023-02127 CVE-2023-2268 · GHSA-h663-pvcv-f942

Plane v0.7.1 - Unauthorized access to files

HIGH 68

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00662 Published 2023-07-15 No fix listed CWE-862

TI-2026-67846 CVE-2026-104977

Incomplete fix leaves SSRF in Plane work-item link unfurling

HIGH 67

Plane is an open-source project management tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00303 Published 2026-10-05 Fixed in 1.4.0 CWE-918

TI-2026-28725 CVE-2026-39843

Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching

HIGH 67

Plane is an an open-source project management tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00255 Published 2026-04-09 Fixed in 1.3.0 CWE-918

TI-2026-28361 CVE-2026-39374

Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint

HIGH 67

Plane is an an open-source project management tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00216 Published 2026-04-07 Fixed in 1.3.0 CWE-639

TI-2026-67856 CVE-2026-105631

Plane asset download endpoints expose files from private projects

HIGH 66

Plane is an open-source project management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00294 Published 2026-10-05 Fixed in 1.4.0 CWE-639

TI-2026-67853 CVE-2026-105628

Plane OAuth avatar sync flaw exposes internal data via SSRF

HIGH 66

Plane is an open-source project management tool.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00291 Published 2026-10-05 Fixed in 1.4.0 CWE-918

Open these records in search →