Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: superplanehq Clear all filters
TI-2026-41406 CVE-2026-57511 · GHSA-c3mp-rj38-mpvh

SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

Priority LOW 28

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via w…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00404 Published 2026-07-28 Fixed in 0.30.0 CWE-93
TI-2026-41405 CVE-2026-57510 · GHSA-hg7x-q6w3-jcf5

SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

Priority MEDIUM 41

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belo…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00624 Published 2026-07-28 Fixed in 0.27.0 CWE-639