Information Disclosure

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without TokenCVE-2026-105635makeplane · CVSS 7.4 · 0.4% likely

   CWE-200

2. Plane: Unauthenticated Workspace Member Information DisclosureCVE-2026-30244makeplane · CVSS 7.5 · 0.4% likely

   CWE-200

3. Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in PlaneCVE-2026-105639makeplane · CVSS 9.8 · 0.4% likely

   CWE-200

4. Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace memberCVE-2026-104963makeplane · CVSS 4.3 · 0.3% likely

   CWE-200

5. Plane: Unauthenticated Workspace Invitation Token LeakageCVE-2026-102981makeplane · CVSS 6.5 · 0.2% likely

   CWE-200

6. Plane Exposes User Email (PII and part of credential) in GET ParameterCVE-2026-27949makeplane · CVSS 2 · 0.2% likely

   CWE-598

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.