Vulnerabilidades en makeplane
55 resultadosCVE-2025-62716HIGHPlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path ParameterEPSS 0.3%CVE-2026-105637CRITICALPlane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)EPSS 0.3%CVE-2026-104960MEDIUMPlane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usersEPSS 0.3%CVE-2026-104968HIGHPlane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/EPSS 0.3%CVE-2026-105632HIGHPlane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectsEPSS 0.3%CVE-2026-39374MEDIUMPlane IDOR: Cross-Project Issue Date Modification via Bulk Update EndpointEPSS 0.3%CVE-2026-104977HIGHPlane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOUEPSS 0.3%CVE-2026-104962MEDIUMPlane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)EPSS 0.3%CVE-2026-105633HIGHPlane: Issue Attachment Ownership Hijacking via Missing `issue_id` ScopeEPSS 0.3%CVE-2026-105634HIGHPlane: Privilege Escalation: Project Guest Can Demote Admin/Member RolesEPSS 0.3%CVE-2026-105628HIGHPlane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset EndpointEPSS 0.3%CVE-2026-27949LOWPlane Exposes User Email (PII and part of credential) in GET ParameterEPSS 0.3%CVE-2026-104964MEDIUMPlane: Cross-Workspace Project Modification via Unscoped Project LookupEPSS 0.3%CVE-2026-104978HIGHPlane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only AcceptanceEPSS 0.3%CVE-2025-21616MEDIUMPlane has a Cross-site scripting (XSS) via SVG image uploadEPSS 0.3%CVE-2026-104973HIGHPlane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook DeliveryEPSS 0.3%CVE-2026-104969MEDIUMPlane: Cross-Tenant Cycle Issue Hijack via IDOREPSS 0.3%CVE-2026-104970HIGHPlane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance adminsEPSS 0.3%CVE-2026-104975HIGHPlane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpointsEPSS 0.3%CVE-2025-48070LOWPlane has insecure permissions in UserSerializerEPSS 0.3%