Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: planka Clear all filters
TI-2026-68412 CVE-2026-105835 · GHSA-vxgr-w3f5-4g4j

Brute force of TOTP codes in PLANKA via verify-totp endpoint

Priority MEDIUM 41

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00317 Published 2026-10-06 No fix listed CWE-307
TI-2022-02453 CVE-2022-2653 · GHSA-5c4f-cr5c-fm9x

Path Traversal in plankanban/planka

Priority LOW 31

With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01009 Published 2022-08-04 Fixed in 1.5.1 CWE-22