Vendor
Makeplane vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 17 vulnerabilities in Makeplane: 0 in the last 7 days and 13 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111869, was published on 18 October 2026. 1 vulnerability in the last four weeks, down 92% on the four before (12). 0 critical against 2. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 13
- Critical, all time
- 2
- Exploited in the wild
- 0
About Makeplane
Makeplane is the company behind the open-source project management platform Plane.
Makeplane technologies
Latest Makeplane vulnerabilities
- CVE-2026-111869: makeplane plane rate limit bypass via X-Forwarded-For headermediumCVSS 5.3
- CVE-2026-105640: Plane account takeover via unverified OAuth emailcriticalCVSS 9.1
- CVE-2026-105637: Plane project management asset IDOR in bulk-asset endpointcriticalCVSS 9.6
- CVE-2026-105634: Plane privilege escalation in project member role updateshighCVSS 8.1
- CVE-2026-105631: Plane project management tool asset access control bypasshighCVSS 7.5
- CVE-2026-105630: Plane stored XSS via SVG attachment inline servinghighCVSS 8.7
- CVE-2026-105629: Plane cross-tenant IDOR in estimate point deletionhighCVSS 7.1
- CVE-2026-104977: Plane incomplete SSRF fix in work-item link unfurlinghighCVSS 7.7
- CVE-2026-104973: Plane DNS rebinding bypass in webhook delivery SSRF protectionhighCVSS 7.6
- CVE-2026-104970: Plane instance admin signup race conditionhighCVSS 8.1
- CVE-2026-104960: Plane access control bypass in asset download endpointmediumCVSS 6.5
- CVE-2026-104955: Plane project member role-change authorization bypassmediumCVSS 5.4
- CVE-2026-104892: Plane API token logging plaintext exposureinfo
- CVE-2026-46558: Plane cross-workspace asset authorization bypasshighCVSS 8.3
- CVE-2026-40102: Plane ORM field reference injection in SavedAnalyticEndpointmediumCVSS 6.5
- CVE-2026-27949: Makeplane Plane information exposure in authentication flowlowCVSS 2EPSS 0.2%
- CVE-2026-39374: Makeplane Plane IDOR in IssueBulkUpdateDateEndpointmediumCVSS 6.5EPSS 0.2%
Most severe Makeplane vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-105637: Plane project management asset IDOR in bulk-asset endpointcriticalCVSS 9.6
- CVE-2026-105640: Plane account takeover via unverified OAuth emailcriticalCVSS 9.1
- CVE-2026-105630: Plane stored XSS via SVG attachment inline servinghighCVSS 8.7
- CVE-2026-46558: Plane cross-workspace asset authorization bypasshighCVSS 8.3
- CVE-2026-105634: Plane privilege escalation in project member role updateshighCVSS 8.1
- CVE-2026-104970: Plane instance admin signup race conditionhighCVSS 8.1
- CVE-2026-104977: Plane incomplete SSRF fix in work-item link unfurlinghighCVSS 7.7
- CVE-2026-104973: Plane DNS rebinding bypass in webhook delivery SSRF protectionhighCVSS 7.6
- CVE-2026-105631: Plane project management tool asset access control bypasshighCVSS 7.5
- CVE-2026-105629: Plane cross-tenant IDOR in estimate point deletionhighCVSS 7.1
Vulnerabilities per week
1 vulnerability in the last four weeks, down 92% on the four before (12). 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 12 | 2 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Makeplane vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/makeplane)<a href="https://junglewise.ai/threats/vendors/makeplane"><img src="https://junglewise.ai/threats/vendors/makeplane/badge.svg" alt="Makeplane vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/makeplane.json, and this page as text at https://junglewise.ai/threats/vendors/makeplane.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Makeplane vulnerabilities", https://junglewise.ai/threats/vendors/makeplane, 9 November 2026.