agentprime: plane

agentprime: planeEvery new CVE for plane.https://agentprime.io/CVE-2026-111869: makeplane API Endpoint reliance on untrusted inputs in a security decisionhttps://agentprime.io/advisories/CVE-2026-111869/https://agentprime.io/advisories/CVE-2026-111869/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 18 Oct 2026 02:45:15 GMTCVECVE-2026-102980: Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scopehttps://agentprime.io/advisories/CVE-2026-102980/https://agentprime.io/advisories/CVE-2026-102980/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:33:07 GMTCVECVE-2026-102985: Plane: Any project member can modify (deactivate) other members' recordshttps://agentprime.io/advisories/CVE-2026-102985/https://agentprime.io/advisories/CVE-2026-102985/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:31:13 GMTCVECVE-2026-102986: Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/https://agentprime.io/advisories/CVE-2026-102986/https://agentprime.io/advisories/CVE-2026-102986/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:29:04 GMTCVECVE-2026-102981: Plane: Unauthenticated Workspace Invitation Token Leakagehttps://agentprime.io/advisories/CVE-2026-102981/https://agentprime.io/advisories/CVE-2026-102981/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 15:34:25 GMTCVECVE-2026-102982: Plane: XSS in work item commentshttps://agentprime.io/advisories/CVE-2026-102982/https://agentprime.io/advisories/CVE-2026-102982/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 15:32:10 GMTCVECVE-2026-102988: Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)https://agentprime.io/advisories/CVE-2026-102988/https://agentprime.io/advisories/CVE-2026-102988/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 15:30:42 GMTCVECVE-2026-105641: Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypasshttps://agentprime.io/advisories/CVE-2026-105641/https://agentprime.io/advisories/CVE-2026-105641/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:12:33 GMTCVEcriticalCVE-2026-105640: Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)https://agentprime.io/advisories/CVE-2026-105640/https://agentprime.io/advisories/CVE-2026-105640/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:11:35 GMTCVEcriticalCVE-2026-105639: Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Planehttps://agentprime.io/advisories/CVE-2026-105639/https://agentprime.io/advisories/CVE-2026-105639/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:10:35 GMTCVEcriticalCVE-2026-105638: Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forcehttps://agentprime.io/advisories/CVE-2026-105638/https://agentprime.io/advisories/CVE-2026-105638/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:09:35 GMTCVEcriticalCVE-2026-105637: Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)https://agentprime.io/advisories/CVE-2026-105637/https://agentprime.io/advisories/CVE-2026-105637/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:04:02 GMTCVEcriticalCVE-2026-105636: Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)https://agentprime.io/advisories/CVE-2026-105636/https://agentprime.io/advisories/CVE-2026-105636/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:02:53 GMTCVEcriticalCVE-2026-105635: Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Tokenhttps://agentprime.io/advisories/CVE-2026-105635/https://agentprime.io/advisories/CVE-2026-105635/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:01:52 GMTCVECVE-2026-105634: Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roleshttps://agentprime.io/advisories/CVE-2026-105634/https://agentprime.io/advisories/CVE-2026-105634/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 18:00:50 GMTCVECVE-2026-105633: Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scopehttps://agentprime.io/advisories/CVE-2026-105633/https://agentprime.io/advisories/CVE-2026-105633/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:58:32 GMTCVECVE-2026-105632: Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectshttps://agentprime.io/advisories/CVE-2026-105632/https://agentprime.io/advisories/CVE-2026-105632/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:57:22 GMTCVECVE-2026-105631: Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosurehttps://agentprime.io/advisories/CVE-2026-105631/https://agentprime.io/advisories/CVE-2026-105631/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:55:56 GMTCVECVE-2026-105630: Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)https://agentprime.io/advisories/CVE-2026-105630/https://agentprime.io/advisories/CVE-2026-105630/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:54:01 GMTCVECVE-2026-105629: Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookuphttps://agentprime.io/advisories/CVE-2026-105629/https://agentprime.io/advisories/CVE-2026-105629/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:53:01 GMTCVECVE-2026-105628: Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpointhttps://agentprime.io/advisories/CVE-2026-105628/https://agentprime.io/advisories/CVE-2026-105628/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:51:01 GMTCVECVE-2026-104979: Plane: Cross-tenant stored XSS in intake enables account takeoverhttps://agentprime.io/advisories/CVE-2026-104979/https://agentprime.io/advisories/CVE-2026-104979/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:49:53 GMTCVECVE-2026-104978: Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptancehttps://agentprime.io/advisories/CVE-2026-104978/https://agentprime.io/advisories/CVE-2026-104978/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:48:34 GMTCVECVE-2026-104977: Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOUhttps://agentprime.io/advisories/CVE-2026-104977/https://agentprime.io/advisories/CVE-2026-104977/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:47:29 GMTCVECVE-2026-104976: Plane: SSRF in Gitea OAuthhttps://agentprime.io/advisories/CVE-2026-104976/https://agentprime.io/advisories/CVE-2026-104976/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:45:43 GMTCVECVE-2026-104975: Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpointshttps://agentprime.io/advisories/CVE-2026-104975/https://agentprime.io/advisories/CVE-2026-104975/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:44:24 GMTCVECVE-2026-104974: Plane: Disabled User Auto-Reactivation on Loginhttps://agentprime.io/advisories/CVE-2026-104974/https://agentprime.io/advisories/CVE-2026-104974/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:42:45 GMTCVECVE-2026-104973: Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Deliveryhttps://agentprime.io/advisories/CVE-2026-104973/https://agentprime.io/advisories/CVE-2026-104973/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:41:33 GMTCVECVE-2026-104971: Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorizationhttps://agentprime.io/advisories/CVE-2026-104971/https://agentprime.io/advisories/CVE-2026-104971/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 17:04:27 GMTCVECVE-2026-104970: Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance adminshttps://agentprime.io/advisories/CVE-2026-104970/https://agentprime.io/advisories/CVE-2026-104970/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:58:55 GMTCVECVE-2026-104969: Plane: Cross-Tenant Cycle Issue Hijack via IDORhttps://agentprime.io/advisories/CVE-2026-104969/https://agentprime.io/advisories/CVE-2026-104969/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:57:52 GMTCVECVE-2026-104968: Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/https://agentprime.io/advisories/CVE-2026-104968/https://agentprime.io/advisories/CVE-2026-104968/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:56:50 GMTCVECVE-2026-104967: Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpointhttps://agentprime.io/advisories/CVE-2026-104967/https://agentprime.io/advisories/CVE-2026-104967/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:55:28 GMTCVECVE-2026-104966: Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaceshttps://agentprime.io/advisories/CVE-2026-104966/https://agentprime.io/advisories/CVE-2026-104966/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:54:27 GMTCVECVE-2026-104965: Plane: Cross-Tenant Issue Relation Creation via IDORhttps://agentprime.io/advisories/CVE-2026-104965/https://agentprime.io/advisories/CVE-2026-104965/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:53:22 GMTCVECVE-2026-104964: Plane: Cross-Workspace Project Modification via Unscoped Project Lookuphttps://agentprime.io/advisories/CVE-2026-104964/https://agentprime.io/advisories/CVE-2026-104964/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:52:28 GMTCVECVE-2026-104963: Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace memberhttps://agentprime.io/advisories/CVE-2026-104963/https://agentprime.io/advisories/CVE-2026-104963/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:51:25 GMTCVECVE-2026-104962: Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)https://agentprime.io/advisories/CVE-2026-104962/https://agentprime.io/advisories/CVE-2026-104962/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:50:27 GMTCVECVE-2026-104961: Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner accesshttps://agentprime.io/advisories/CVE-2026-104961/https://agentprime.io/advisories/CVE-2026-104961/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:49:26 GMTCVECVE-2026-104960: Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usershttps://agentprime.io/advisories/CVE-2026-104960/https://agentprime.io/advisories/CVE-2026-104960/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:48:23 GMTCVECVE-2026-104956: Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)https://agentprime.io/advisories/CVE-2026-104956/https://agentprime.io/advisories/CVE-2026-104956/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:47:10 GMTCVECVE-2026-104955: Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)https://agentprime.io/advisories/CVE-2026-104955/https://agentprime.io/advisories/CVE-2026-104955/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:42:25 GMTCVECVE-2026-104894: Plane: Cross-Tenant Module Issue Linking via IDORhttps://agentprime.io/advisories/CVE-2026-104894/https://agentprime.io/advisories/CVE-2026-104894/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:41:22 GMTCVECVE-2026-104893: Plane: Improper validation allows arbitrary modification of API token rate limitshttps://agentprime.io/advisories/CVE-2026-104893/https://agentprime.io/advisories/CVE-2026-104893/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:40:12 GMTCVECVE-2026-104892: Plane: Plaintext logging of API tokenhttps://agentprime.io/advisories/CVE-2026-104892/https://agentprime.io/advisories/CVE-2026-104892/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 16:00:41 GMTCVECVE-2026-86174: Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Boardhttps://agentprime.io/advisories/CVE-2026-86174/https://agentprime.io/advisories/CVE-2026-86174/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 11:01:26 GMTCVECVE-2026-15342: CVE-2026-15342https://agentprime.io/advisories/CVE-2026-15342/https://agentprime.io/advisories/CVE-2026-15342/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 16:42:52 GMTCVECVE-2026-10850: Plane 1.3.1 - Stored XSS in intake issue description_htmlhttps://agentprime.io/advisories/CVE-2026-10850/https://agentprime.io/advisories/CVE-2026-10850/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 14:39:51 GMTCVECVE-2026-46558: Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaceshttps://agentprime.io/advisories/CVE-2026-46558/https://agentprime.io/advisories/CVE-2026-46558/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 15:42:06 GMTCVECVE-2026-40102: Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analyticshttps://agentprime.io/advisories/CVE-2026-40102/https://agentprime.io/advisories/CVE-2026-40102/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 20 May 2026 21:36:54 GMTCVE