CVE-2026-39843

>= 0.28.0 and < 1.3.0

Plane is an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incompl

7.7HIGH

CVE-2026-27949

< 1.3.0

Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow

2.0LOW

CVE-2026-39374

< 1.3.0

Plane is an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN

6.5MEDIUM

CVE-2026-30244

< 1.2.2

Plane is an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace memb

7.5HIGH

CVE-2026-30242

< 1.2.3

Plane is an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/we

8.5HIGH

CVE-2026-27706

< 1.2.2

Plane is an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnera

7.7HIGH

CVE-2026-27705

< 1.2.2

Plane is an open-source project management tool. Prior to version 1.2.2, the ProjectAssetEndpoint.patch() method in `apps/api

6.5MEDIUM

CVE-2025-69284

all versions

Plane is an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]

4.3MEDIUM

CVE-2025-48070

< 0.23.0

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows u

3.5LOW

CVE-2025-21616

< 0.23.0

Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions

5.4MEDIUM

CVE-2024-47830

< 0.23.0

Plane is an open-source project management tool. Plane uses the wildcard support to retrieve the image from any hostname as in

9.3CRITICAL

CVE-2023-30791

all versions

Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension t

7.1HIGH

CVE-2023-2268

all versions

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.

7.1HIGH