CVE-2026-102985
Plane: Any project member can modify (deactivate) other members' records
CVSS score
6.5
EPSS probability
%0.3
Risk score
0.0
Published
1 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
M
Patch status unknownEPSS %0
8.1
CVE-2026-104974
Plane: Disabled User Auto-Reactivation on Login
M
Patch status unknownEPSS %1
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
M
Patch status unknownEPSS %0
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
M
Patch status unknownEPSS %0
9.1
CVE-2026-105638
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
M
Patch status unknownEPSS %0
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
M
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-102985"