Vendor
Plane vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 32 vulnerabilities in Plane: 0 in the last 7 days and 29 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102985, was published on 14 October 2026. 4 vulnerabilities in the last four weeks, down 84% on the four before (25). 0 critical against 4. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 29
- Critical, all time
- 4
- Exploited in the wild
- 0
About Plane
An open-source project management platform designed as an alternative to Jira.
Plane technologies
- Plane31
Latest Plane vulnerabilities
- CVE-2026-102985: Plane project management missing authorization checksmediumCVSS 6.5EPSS 0.3%
- CVE-2026-102988: Plane order_by injection in issue-listing endpointsmediumCVSS 5.3EPSS 0.2%
- CVE-2026-102982: Plane stored XSS in comments and intake descriptionsinfoEPSS 0.4%
- CVE-2026-102981: Plane workspace invitation token disclosure and hijackmediumCVSS 6.5EPSS 0.2%
- CVE-2026-105641: Plane hardcoded Django SECRET_KEY in community deploymentscriticalCVSS 9.8
- CVE-2026-105639: Plane workspace invitation hijacking and token disclosurecriticalCVSS 9.8
- CVE-2026-105638: Plane magic-code OTP brute-force in email logincriticalCVSS 9.1
- CVE-2026-105636: Plane webhook delivery SSRF via redirect bypasscriticalCVSS 9.9
- CVE-2026-105635: Plane project invite email disclosurehighCVSS 7.4
- CVE-2026-105633: Plane attachment ownership bypass via missing issue_id scopinghighCVSS 7.1
- CVE-2026-105632: Plane project management authorization bypass in GraphQLinfo
- CVE-2026-105628: Plane OAuth avatar SSRF via unvalidated redirecthighCVSS 7.6
- CVE-2026-104979: Plane cross-site scripting in intake item descriptionshighCVSS 8.7
- CVE-2026-104978: Plane authorization bypass in project invitation endpointshighCVSS 8.2
- CVE-2026-104976: Plane project management SSRF via unvalidated Gitea OAuth avatarinfo
- CVE-2026-104975: Plane cross-project asset IDOR in Spaces apphighCVSS 7.1
- CVE-2026-104974: Plane authentication bypass in account deactivationhighCVSS 8.1
- CVE-2026-104971: Plane authorization bypass in asset and workspace endpointshighCVSS 8.5
- CVE-2026-104969: Plane cross-tenant IDOR in cycle-issues endpointmediumCVSS 6.5
- CVE-2026-104968: Plane authentication bypass in entity-search endpointinfo
- CVE-2026-104967: Plane authorization bypass in bulk delete and sub-issue endpointsmediumCVSS 5.4
- CVE-2026-104966: Plane authorization bypass in estimates and comments endpointsinfo
- CVE-2026-104965: Plane issue-relation endpoint insecure direct object referencemediumCVSS 5.4
- CVE-2026-104964: Plane project update cross-workspace access control bypassmediumCVSS 6.8
- CVE-2026-104963: Plane project management information disclosure in workspace cycles/modulesmediumCVSS 4.3
Most severe Plane vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-105636: Plane webhook delivery SSRF via redirect bypasscriticalCVSS 9.9
- CVE-2026-105641: Plane hardcoded Django SECRET_KEY in community deploymentscriticalCVSS 9.8
- CVE-2026-105639: Plane workspace invitation hijacking and token disclosurecriticalCVSS 9.8
- CVE-2026-105638: Plane magic-code OTP brute-force in email logincriticalCVSS 9.1
- CVE-2026-104979: Plane cross-site scripting in intake item descriptionshighCVSS 8.7
- CVE-2026-104971: Plane authorization bypass in asset and workspace endpointshighCVSS 8.5
- CVE-2026-104978: Plane authorization bypass in project invitation endpointshighCVSS 8.2
- CVE-2026-104974: Plane authentication bypass in account deactivationhighCVSS 8.1
- CVE-2026-39843: Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of…highCVSS 7.7EPSS 0.3%
- CVE-2026-105628: Plane OAuth avatar SSRF via unvalidated redirecthighCVSS 7.6
Vulnerabilities per week
4 vulnerabilities in the last four weeks, down 84% on the four before (25). 0 critical against 4. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 25 | 4 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Plane vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/plane)<a href="https://junglewise.ai/threats/vendors/plane"><img src="https://junglewise.ai/threats/vendors/plane/badge.svg" alt="Plane vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/plane.json, and this page as text at https://junglewise.ai/threats/vendors/plane.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Plane vulnerabilities", https://junglewise.ai/threats/vendors/plane, 13 November 2026.