Vulnerabilidades en makeplane
55 resultadosCVE-2026-104893MEDIUMPlane: Improper validation allows arbitrary modification of API token rate limitsEPSS 0.3%CVE-2026-104966HIGHPlane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across WorkspacesEPSS 0.2%CVE-2026-104976HIGHPlane: SSRF in Gitea OAuthEPSS 0.2%CVE-2026-104892HIGHPlane: Plaintext logging of API tokenEPSS 0.2%CVE-2026-105629HIGHPlane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key LookupEPSS 0.2%CVE-2026-104894MEDIUMPlane: Cross-Tenant Module Issue Linking via IDOREPSS 0.2%CVE-2026-105631HIGHPlane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosureEPSS 0.2%CVE-2026-104965MEDIUMPlane: Cross-Tenant Issue Relation Creation via IDOREPSS 0.2%CVE-2026-105630HIGHPlane: Stored XSS via SVG attachment served inline on the application origin (account takeover)EPSS 0.2%CVE-2025-55203MEDIUMPlane Stored XSS in Add Work Item FunctionalityEPSS 0.2%CVE-2026-104963MEDIUMPlane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace memberEPSS 0.2%CVE-2025-69284MEDIUMIn plane.io, a Guest User to a Workspace can still be able to see list of membersEPSS 0.2%CVE-2026-104955MEDIUMPlane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)EPSS 0.2%CVE-2026-104961MEDIUMPlane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner accessEPSS 0.2%CVE-2026-104967MEDIUMPlane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpointEPSS 0.2%