Product by Makeplane

    Plane

    62 known vulnerabilities in Plane (Makeplane), 0 of them actively exploited (CISA KEV).

    Key figures

    62

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Plane (Makeplane)
    CriticalCVE-2026-105641

    Makeplane Plane: Use of Hard-coded Credentials

    		9.8
    CriticalCVE-2026-105636

    Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

    		9.9
    CriticalCVE-2026-105639

    Makeplane Plane: Authorization Bypass Through User-Controlled Key

    		9.8
    HighCVE-2026-102986

    Makeplane Plane: Authorization Bypass Through User-Controlled Key

    		8.1
    HighCVE-2026-104974

    Plane: Disabled User Auto-Reactivation on Login

    		8.1
    CriticalCVE-2026-105640

    Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

    		9.1
    CriticalCVE-2026-105638

    Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

    		9.1
    CriticalCVE-2026-105637

    Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

    		9.6
    HighCVE-2026-104979

    Plane: Cross-tenant stored XSS in intake enables account takeover

    		8.7
    MediumCVE-2026-111869

    makeplane API Endpoint reliance on untrusted inputs in a security decision

    		5.3
    HighCVE-2026-102982

    Plane: XSS in work item comments

    		—
    HighCVE-2026-105635

    Makeplane Plane: Exposure of Sensitive Information to an Unauthorized Actor

    		7.4
    HighCVE-2026-104971

    Makeplane Plane: Authorization Bypass Through User-Controlled Key

    		8.5
    HighCVE-2026-104978

    Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

    		8.2
    HighCVE-2026-105632

    Makeplane Plane: Improper Access Control

    		—
    HighCVE-2026-104968

    Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

    		—
    HighCVE-2026-104976

    Plane: SSRF in Gitea OAuth

    		—
    HighCVE-2026-104966

    Makeplane Plane: Authorization Bypass Through User-Controlled Key

    		—
    HighCVE-2026-104892

    Plane: Plaintext logging of API token

    		—
    HighCVE-2026-105630

    Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

    		8.7
    HighCVE-2026-105634

    Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

    		8.1
    HighCVE-2026-104973

    Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

    		7.6
    HighCVE-2026-104970

    Makeplane Plane: Race Condition

    		8.1
    HighCVE-2026-104977

    Makeplane Plane: Server-Side Request Forgery (SSRF)

    		7.7
    CriticalCVE-2024-31461

    Plane Server-Side Request Forgery (SSRF) Vulnerability

    		9.1

    All vulnerabilities in search

    All products by Makeplane