Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
CVE-2026-104978
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible
2026-10-06 归档
今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表A malicious frontend can cause a daemon panic
CVE-2026-93319
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data ra
Plane: SSRF in Gitea OAuth
CVE-2026-104976
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and
Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
CVE-2026-104975
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/as
Container blob cache can accept unverified content
CVE-2026-93317
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not ma
Plane: Disabled User Auto-Reactivation on Login
CVE-2026-104974
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is
Starting daemon with --cdi-disabled flag can lead to panic on specific builds
CVE-2026-93316
If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This c
Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-104973
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP address
Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
CVE-2026-104971
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
CVE-2026-102282
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the
Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins
CVE-2026-104970
Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/li
Plane: Cross-Tenant Cycle Issue Hijack via IDOR
CVE-2026-104969
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the re
Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
CVE-2026-104968
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=us
Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
CVE-2026-104966
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resour
Plane: Cross-Tenant Issue Relation Creation via IDOR
CVE-2026-104965
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the
Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
CVE-2026-104964
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller a
Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
CVE-2026-104963
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc
Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
CVE-2026-104962
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/mem
Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
CVE-2026-104961
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=Tru
Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
CVE-2026-104960
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w