[ Vendor · 45 CVEs ]
makeplane
CVEs affecting makeplane published in the last 30 days, plus any makeplane CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111869 | 18 Oct 2026 | CVSS 5.3 | makeplane planeA vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of… | |
| CVE-2026-102980 | 14 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version… | |
| CVE-2026-102985 | 14 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the… | |
| CVE-2026-102986 | 14 Oct 2026 | CVSS 8.1 | makeplane planePlane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint… | |
| CVE-2026-102981 | 13 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to… | |
| CVE-2026-102982 | 13 Oct 2026 | CVSS 8.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A… | |
| CVE-2026-102988 | 13 Oct 2026 | CVSS 5.3 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards… | |
| CVE-2026-105638 | 5 Oct 2026 | CVSS 9.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20… | |
| CVE-2026-105639 | 5 Oct 2026 | CVSS 9.8 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an… | |
| CVE-2026-105640 | 5 Oct 2026 | CVSS 9.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab… | |
| CVE-2026-105641 | 5 Oct 2026 | CVSS 9.8 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide… | |
| CVE-2026-105634 | 5 Oct 2026 | CVSS 8.1 | makeplane planePlane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including… | |
| CVE-2026-105635 | 5 Oct 2026 | CVSS 7.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/… | |
| CVE-2026-105636 | 5 Oct 2026 | CVSS 9.9 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls… | |
| CVE-2026-105637 | 5 Oct 2026 | CVSS 9.6 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves… | |
| CVE-2026-105629 | 5 Oct 2026 | CVSS 7.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare… | |
| CVE-2026-105630 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an… | |
| CVE-2026-105631 | 5 Oct 2026 | CVSS 7.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve… | |
| CVE-2026-105632 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any… | |
| CVE-2026-105633 | 5 Oct 2026 | CVSS 7.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from… | |
| CVE-2026-105628 | 5 Oct 2026 | CVSS 7.6 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data… | |
| CVE-2026-104977 | 5 Oct 2026 | CVSS 7.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link… | |
| CVE-2026-104978 | 5 Oct 2026 | CVSS 8.2 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who… | |
| CVE-2026-104979 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through… | |
| CVE-2026-104971 | 5 Oct 2026 | CVSS 8.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the… | |
| CVE-2026-104973 | 5 Oct 2026 | CVSS 7.6 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is… | |
| CVE-2026-104974 | 5 Oct 2026 | CVSS 8.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log… | |
| CVE-2026-104975 | 5 Oct 2026 | CVSS 7.1 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for… | |
| CVE-2026-104976 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that… | |
| CVE-2026-104965 | 5 Oct 2026 | CVSS 5.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without… | |
| CVE-2026-104966 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the… | |
| CVE-2026-104967 | 5 Oct 2026 | CVSS 5.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/… | |
| CVE-2026-104968 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns… | |
| CVE-2026-104969 | 5 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating… | |
| CVE-2026-104970 | 5 Oct 2026 | CVSS 8.1 | makeplane planePlane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in… | |
| CVE-2026-104956 | 5 Oct 2026 | CVSS 5.3 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query… | |
| CVE-2026-104960 | 5 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET… | |
| CVE-2026-104961 | 5 Oct 2026 | CVSS 5.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a… | |
| CVE-2026-104962 | 5 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete… | |
| CVE-2026-104963 | 5 Oct 2026 | CVSS 4.3 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET… | |
| CVE-2026-104964 | 5 Oct 2026 | CVSS 6.8 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in… | |
| CVE-2026-104893 | 5 Oct 2026 | CVSS 5.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token… | |
| CVE-2026-104894 | 5 Oct 2026 | CVSS 4.3 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that… | |
| CVE-2026-104955 | 5 Oct 2026 | CVSS 5.4 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update… | |
| CVE-2026-104892 | 5 Oct 2026 | CVSS 8.7 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low… |