Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Plane — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in Plane, with AI-generated Chinese analysis, references, and POCs.

Plane is an open-source project management tool categorized under web application vulnerabilities. This page aggregates security advisories and reported issues related to the Plane application software, covering incidents from its initial public release through the current date. Here, you can track vendor-specific advisories, understand common weakness classes affecting the platform, and look up the product’s historical vulnerability data to assess risk exposure. The collected data includes cross-site scripting flaws, authentication bypasses, and information disclosure issues that have been publicly reported or patched in recent updates. Users can navigate through chronological records to identify patterns in defect discovery and remediation efforts. This resource is designed for security analysts, developers, and system administrators who need to evaluate the security posture of Plane instances within their environments. By consolidating disparate reports into a single view, the page facilitates faster impact analysis and informed decision-making regarding patch management and mitigation strategies. All entries are sourced from official channels and reputable security databases to ensure accuracy and relevance. The focus remains strictly on factual reporting of known defects without speculation or assessment of likelihood. This structured approach allows for efficient monitoring of emerging threats and supports proactive defense measures against exploited weaknesses.

Vendor: Plane

CVE IDTitleCVSSSeverityPublished
CVE-2026-15342 CVE-2026-15342 --2026-07-21
CVE-2026-10850 Plane 1.3.1 - Stored XSS in intake issue description_html CWE-79--2026-06-17
CVE-2026-46558 Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces CWE-639 8.3 High2026-06-10
CVE-2026-40102 Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics CWE-943 6.5 Medium2026-05-20
CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching CWE-918 7.7 High2026-04-09
CVE-2026-27949 Plane Exposes User Email (PII and part of credential) in GET Parameter CWE-200 2.0 Low2026-04-07
CVE-2026-39374 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint CWE-639 6.5 Medium2026-04-07
CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer CWE-918 8.5 High2026-03-06
CVE-2026-30244 Plane: Unauthenticated Workspace Member Information Disclosure CWE-284 7.5 High2026-03-06
CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature CWE-918 7.7 High2026-02-25
CVE-2026-27705 Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch CWE-639 6.5AIMediumAI2026-02-25
CVE-2025-69284 In plane.io, a Guest User to a Workspace can still be able to see list of members CWE-284 4.3 Medium2026-01-02
CVE-2025-62716 Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter CWE-79 8.1 High2025-10-24
CVE-2025-55203 Plane Stored XSS in Add Work Item Functionality CWE-79 5.4 Medium2025-08-15
CVE-2025-48070 Plane has insecure permissions in UserSerializer CWE-276 3.5 Low2025-05-21
CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload CWE-79 5.4 Medium2025-01-06
CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint CWE-918 9.3 Critical2024-10-11
CVE-2024-31461 Plane Server-Side Request Forgery (SSRF) Vulnerability CWE-918 9.1 Critical2024-04-10
CVE-2023-30791 Plane 0.7.1 - Insecure file upload CWE-434 7.1 High2023-07-15
CVE-2023-2268 Plane v0.7.1 - Unauthorized access to files CWE-862 7.1 High2023-07-15

All 20 known CVE vulnerabilities affecting Plane with full Chinese analysis, references, and POCs where available.