Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
CVE-2026-104966
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resour
#advisory
共收录 23210 条相关情报。
← 返回所有主题Plane: Cross-Tenant Issue Relation Creation via IDOR
CVE-2026-104965
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the
Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
CVE-2026-104964
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller a
Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
CVE-2026-104963
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyc
Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
CVE-2026-104962
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/mem
Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
CVE-2026-104961
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=Tru
Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
CVE-2026-104960
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w
Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
CVE-2026-104956
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts grou
Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request
Plane: Cross-Tenant Module Issue Linking via IDOR
CVE-2026-104894
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL pat
Plane: Improper validation allows arbitrary modification of API token rate limits
CVE-2026-104893
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user
auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
CVE-2026-12171
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut
Plane: Plaintext logging of API token
CVE-2026-104892
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
CVE-2026-104890
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/
TallCMS PluginManager ThemeManager.php code injection
CVE-2026-105329
A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms
django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
CVE-2026-105315
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/
Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header
CVE-2026-105396
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attac
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
CVE-2026-105263
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of
vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds
CVE-2026-105251
A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of
vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero
CVE-2026-105250
A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file