Ramas de versiones afectadas
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-111869 | makeplane API Endpoint reliance on untrusted inputs in a security decision | = 1.4.0 = 1.4.1 = 1.4.2 | 6.9 | — | 2026-10-18 | |
| CVE-2026-102980 | Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope | * | 6.5 | — | 2026-10-15 | |
| CVE-2026-102985 | Plane: Any project member can modify (deactivate) other members' records | * | 6.5 | — | 2026-10-15 | |
| CVE-2026-102986 | Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/... | * | 8.1 | — | 2026-10-15 | |
| CVE-2026-102981 | Plane: Unauthenticated Workspace Invitation Token Leakage | * | 6.5 | — | 2026-10-14 | |
| CVE-2026-102982 | Plane: XSS in work item comments | * | 8.5 | — | 2026-10-14 | |
| CVE-2026-102988 | Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) | * | 5.3 | — | 2026-10-14 | |
| CVE-2026-105641 | Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — ses... | * | 9.8 | — | 2026-10-06 | |
| CVE-2026-105640 | Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) | * | 9.1 | — | 2026-10-06 | |
| CVE-2026-105639 | Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane | * | 9.8 | — | 2026-10-06 | |
| CVE-2026-105638 | Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force | * | 9.1 | — | 2026-10-06 | |
| CVE-2026-105637 | Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) | * | 9.6 | — | 2026-10-06 | |
| CVE-2026-105636 | Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) | * | 9.9 | — | 2026-10-06 | |
| CVE-2026-105635 | Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token | * | 7.4 | — | 2026-10-06 | |
| CVE-2026-105634 | Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles | * | 8.1 | — | 2026-10-06 | |
| CVE-2026-105633 | Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope | * | 7.1 | — | 2026-10-06 | |
| CVE-2026-105632 | Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-105631 | Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cro... | * | 7.5 | — | 2026-10-06 | |
| CVE-2026-105630 | Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-105629 | Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup | * | 7.1 | — | 2026-10-06 | |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | * | 7.6 | — | 2026-10-06 | |
| CVE-2026-104979 | Plane: Cross-tenant stored XSS in intake enables account takeover | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-104978 | Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance | * | 8.2 | — | 2026-10-06 | |
| CVE-2026-104977 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + D... | * | 7.7 | — | 2026-10-06 | |
| CVE-2026-104976 | Plane: SSRF in Gitea OAuth | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-104975 | Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints | * | 7.1 | — | 2026-10-06 | |
| CVE-2026-104974 | Plane: Disabled User Auto-Reactivation on Login | * | 8.1 | — | 2026-10-06 | |
| CVE-2026-104973 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery | * | 7.6 | — | 2026-10-06 | |
| CVE-2026-104971 | Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Autho... | * | 8.5 | — | 2026-10-06 | |
| CVE-2026-104970 | Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap... | * | 8.1 | — | 2026-10-06 | |
| CVE-2026-104969 | Plane: Cross-Tenant Cycle Issue Hijack via IDOR | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-104968 | Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/ | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-104967 | Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssue... | * | 5.4 | — | 2026-10-06 | |
| CVE-2026-104966 | Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspace... | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-104965 | Plane: Cross-Tenant Issue Relation Creation via IDOR | * | 5.4 | — | 2026-10-06 | |
| CVE-2026-104964 | Plane: Cross-Workspace Project Modification via Unscoped Project Lookup | * | 6.8 | — | 2026-10-06 | |
| CVE-2026-104963 | Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata... | * | 4.3 | — | 2026-10-06 | |
| CVE-2026-104962 | Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads) | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-104961 | Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access | * | 5.4 | — | 2026-10-06 | |
| CVE-2026-104960 | Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to... | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-104956 | Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + b... | * | 5.3 | — | 2026-10-06 | |
| CVE-2026-104955 | Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Es... | * | 5.4 | — | 2026-10-06 | |
| CVE-2026-104894 | Plane: Cross-Tenant Module Issue Linking via IDOR | * | 4.3 | — | 2026-10-06 | |
| CVE-2026-104893 | Plane: Improper validation allows arbitrary modification of API token rate limits | * | 5.4 | — | 2026-10-06 | |
| CVE-2026-104892 | Plane: Plaintext logging of API token | * | 8.7 | — | 2026-10-06 | |
| CVE-2026-86174 | Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board | ≤ 1.4.2 | 5.3 | — | 2026-09-05 | |
| CVE-2026-46558 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrit... | * < 1.3.1 | 8.3 | — | 2026-06-10 | |
| CVE-2026-40102 | Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics | * < 1.3.1 | 6.5 | — | 2026-05-20 | |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching | * ≥ 0.28.0 < 1.3.0 | 7.7 | — | 2026-04-09 | |
| CVE-2026-27949 | Plane Exposes User Email (PII and part of credential) in GET Parameter | * < 1.3.0 | 4.3 | — | 2026-04-07 | |
| CVE-2026-39374 | Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint | * < 1.3.0 | 7.7 | — | 2026-04-07 | |
| CVE-2026-30244 | Plane: Unauthenticated Workspace Member Information Disclosure | * < 1.2.2 | 7.5 | — | 2026-03-06 | |
| CVE-2026-30242 | Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer | * < 1.2.3 | 8.5 | — | 2026-03-06 | |
| CVE-2026-27705 | Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch | * < 1.2.2 | 4.9 | — | 2026-02-25 | |
| CVE-2026-27706 | Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature | * < 1.2.2 | 7.7 | — | 2026-02-25 | |
| CVE-2025-69284 | In plane.io, a Guest User to a Workspace can still be able to see list of members | * = 1.1.0 | 4.3 | — | 2026-01-02 | |
| CVE-2025-62716 | Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter | * | 8.1 | — | 2025-10-25 | |
| CVE-2025-55203 | Plane Stored XSS in Add Work Item Functionality | * | 5.4 | — | 2025-08-16 | |
| CVE-2025-48070 | Plane has insecure permissions in UserSerializer | * < 0.23.0 | 4.3 | — | 2025-05-21 | |
| CVE-2025-21616 | Plane has a Cross-site scripting (XSS) via SVG image upload | * < 0.23.0 | 5.4 | — | 2025-01-06 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).