CVE-2026-15342 | Medium | 6.5 | 2026-07-21 | Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate… |
CVE-2026-10850 | Medium | 5.4 | 2026-06-17 | Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the A… |
CVE-2026-46558 | High | 8.3 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read… |
CVE-2026-40102 | Medium | 6.5 | 2026-05-20 | Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly… |
CVE-2026-39843 | High | 7.7 | 2026-04-09 | Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the s… |
CVE-2026-27949 | Low | 2.0 | 2026-04-07 | Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address… |
CVE-2026-39374 | Medium | 6.5 | 2026-04-07 | Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the sta… |
CVE-2026-30244 | High | 7.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive inf… |
CVE-2026-30242 | High | 8.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_lo… |
CVE-2026-27706 | High | 7.7 | 2026-02-25 | Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in… |
CVE-2026-27705 | Medium | 6.5 | 2026-02-25 | Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py`… |
CVE-2025-69284 | Medium | 4.3 | 2026-01-02 | Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings… |
CVE-2025-48070 | Low | 3.5 | 2025-05-21 | Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that ar… |
CVE-2025-21616 | Medium | 5.4 | 2025-01-06 | Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerabil… |
CVE-2024-47830 | Critical | 9.3 | 2024-10-11 | Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may… |
CVE-2023-30791 | High | 7.1 | 2023-07-15 | Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and… |
CVE-2023-2268 | High | 7.1 | 2023-07-15 | Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. |