plane

Every one of the 62 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Plane Server-Side Request Forgery (SSRF) VulnerabilityCVE-2024-31461makeplane · CVSS 9.1 · 0.7% likely

   CWE-918

2. Plane allows server side request forgery via /_next/image endpointCVE-2024-47830makeplane · CVSS 9.3 · 0.6% likely

   CWE-918

3. makeplane API Endpoint reliance on untrusted inputs in a security decisionCVE-2026-111869makeplane · CVSS 5.3 · 0.5% likely

   CWE-807

4. Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/CVE-2026-102986makeplane · CVSS 8.1 · 0.5% likely

   CWE-639

5. Plane: Disabled User Auto-Reactivation on LoginCVE-2026-104974makeplane · CVSS 8.1 · 0.5% likely

   CWE-284

6. Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassCVE-2026-105641makeplane · CVSS 9.8 · 0.5% likely

   CWE-798

7. Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without TokenCVE-2026-105635makeplane · CVSS 7.4 · 0.4% likely

   CWE-200

8. Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)CVE-2026-105636makeplane · CVSS 9.9 · 0.4% likely

   CWE-918

9. Plane: Unauthenticated Workspace Member Information DisclosureCVE-2026-30244makeplane · CVSS 7.5 · 0.4% likely

   CWE-200

10. Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in PlaneCVE-2026-105639makeplane · CVSS 9.8 · 0.4% likely

    CWE-200

11. Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project ScopeCVE-2026-102980makeplane · CVSS 6.5 · 0.4% likely

    CWE-639

12. Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)CVE-2026-105640makeplane · CVSS 9.1 · 0.4% likely

    CWE-290

13. Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forceCVE-2026-105638makeplane · CVSS 9.1 · 0.4% likely

    CWE-307

14. Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)CVE-2026-104956makeplane · CVSS 5.3 · 0.4% likely

    CWE-943

15. Plane: SSRF via Incomplete IP Validation in Webhook URL SerializerCVE-2026-30242makeplane · CVSS 8.5 · 0.4% likely

    CWE-918

16. Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only AcceptanceCVE-2026-104978makeplane · CVSS 8.2 · 0.4% likely

    CWE-863

17. Plane: Cross-tenant stored XSS in intake enables account takeoverCVE-2026-104979makeplane · CVSS 8.7 · 0.4% likely

    CWE-79

18. Plane: XSS in work item commentsCVE-2026-102982makeplane · CVSS 8.5 · 0.4% likely

    CWE-79

19. Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing AuthorizationCVE-2026-104971makeplane · CVSS 8.5 · 0.3% likely

    CWE-639

20. Plane: Any project member can modify (deactivate) other members' recordsCVE-2026-102985makeplane · CVSS 6.5 · 0.3% likely

    CWE-862

21. Plane through 1.4.2 Arbitrary Comment Write via Public Deploy BoardCVE-2026-86174makeplane · CVSS 4.3 · 0.3% likely

    CWE-639

22. Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook DeliveryCVE-2026-104973makeplane · CVSS 7.6 · 0.3% likely

    CWE-918

23. Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)CVE-2026-105637makeplane · CVSS 9.6 · 0.3% likely

    CWE-639

24. Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path ParameterCVE-2025-62716makeplane · CVSS 8.1 · 0.3% likely

    CWE-79

25. Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usersCVE-2026-104960makeplane · CVSS 6.5 · 0.3% likely

    CWE-639

26. Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectsCVE-2026-105632makeplane · CVSS 8.7 · 0.3% likely

    CWE-284

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.