makeplane plane

• CVE-2026-39374 Medium 6.5 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint 0.2%
• CVE-2026-30242 High 8.5 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer 0.4%
• CVE-2026-30244 High 7.5 Plane: Unauthenticated Workspace Member Information Disclosure 0.4%
• CVE-2026-27706 High 7.7 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature 0.2%
• CVE-2026-27705 Medium 4.9 Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch 0.2%
• CVE-2025-69284 Medium 4.3 In plane.io, a Guest User to a Workspace can still be able to see list of members 0.2%
• CVE-2025-62716 High 8.1 Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter 0.3%
• CVE-2025-55203 Medium 5.4 Plane Stored XSS in Add Work Item Functionality 0.2%
• CVE-2025-48070 Low 3.5 Plane has insecure permissions in UserSerializer 0.3%
• CVE-2025-21616 Medium 5.4 Plane has a Cross-site scripting (XSS) via SVG image upload 0.3%
• CVE-2024-47830 Critical 9.3 Plane allows server side request forgery via /_next/image endpoint 0.6%
• CVE-2024-31461 Critical 9.1 Plane Server-Side Request Forgery (SSRF) Vulnerability 0.7%