CVE Tools
Track your stack

Makeplane

38 CVEs tracked since 2026. Since Oct 2026, none of them reached CISA KEV.

Makeplane CVEs per month

Oct 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Makeplane CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-10380

Products

The products that kept showing up in Makeplane's monthly top three, with their CVEs summed over those months.

  1. Plane381 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Makeplane.

  1. CVE-2026-105641Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass9.8
  2. CVE-2026-105640Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)9.1
  3. CVE-2026-105639Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane9.8
  4. CVE-2026-105638Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force9.1
  5. CVE-2026-105637Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)9.6
  6. CVE-2026-105636Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)9.9
  7. CVE-2026-105635Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token7.4
  8. CVE-2026-105634Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles8.1
  9. CVE-2026-105633Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope7.1
  10. CVE-2026-105632Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects—
  11. CVE-2026-105631Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure7.5
  12. CVE-2026-105630Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)8.7
  13. CVE-2026-105629Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup7.1
  14. CVE-2026-105628Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint7.6
  15. CVE-2026-104979Plane: Cross-tenant stored XSS in intake enables account takeover8.7

The record

Peak rank
#13 in Oct 2026
Busiest month shown
Oct 2026, 38 CVEs
Months with a KEV entry
0 since Oct 2026
Monthly snapshots
1 since 2026
Makeplane's full record, month by month