P
Vendor security profile
plane
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs49
Critical6
CISA KEV0
Public exploit32
Patch rate%0
Avg. CVSS7.2
12-month vulnerability rate
0
0
1
0
0
2
1
0
0
0
1
44
CVE KEV
CVE severity distribution
49toplam CVE
Critical6 (12%)
High23 (47%)
Medium20 (41%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%65
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
49Unknown
Latest vulnerabilities
6.5
CVE-2026-102980
Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
M
Patch status unknown
6.5
CVE-2026-102985
Plane: Any project member can modify (deactivate) other members' records
M
Patch status unknown
8.1
CVE-2026-102986
Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
M
Patch status unknown
6.5
CVE-2026-102981
Plane: Unauthenticated Workspace Invitation Token Leakage
M
Patch status unknownEPSS %0
8.5
CVE-2026-102982
Plane: XSS in work item comments
M
Patch status unknownEPSS %0
5.3
CVE-2026-102988
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
M
Patch status unknownEPSS %0
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
M
Patch status unknownEPSS %0
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
M
Patch status unknownEPSS %0
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
M
Patch status unknownEPSS %0
9.1
CVE-2026-105638
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
M
Patch status unknownEPSS %0