@stackflag.bsky.socialCVE-2026-105641 - plane
The open‑source Plane tool (versions before 1.4.0) includes deployment files that contain fixed secret keys. If these defaults are not changed, anyone who knows the keys can create…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105640 - plane
The Plane project‑management app (versions before 1.4.0) accepts email addresses from Gitea or self‑hosted GitLab OAuth logins without checking if the provider has verified them. An…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105639 - plane
The open‑source project management tool Plane (versions before 1.4.0) creates a user record for any email address without confirming ownership. Because the invitation details,…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105638 - plane
The Plane project‑management tool lets anyone try unlimited six‑digit email login codes because it does not limit how often a code can be entered. This means an attacker could…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105637 - plane
In versions of Plane before 1.4.0, a user with Guest access could supply identifiers of files that belong to a different project in the same workspace and trick the system into…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105636 - plane
The Plane project‑management app lets users set up webhooks. Because the system follows redirects without checking the final address, a malicious webhook can be made to pull…
Too many irrelevant or confusing CVEs? Use stackflag.com