PL
Product
plane
61
CVEs
0
On KEV
9.9
Max CVSS
44
New 30D
Severity mix
Critical 7High 29Medium 25Low 0
Watch
Add plane to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104893 | 5.4 | Oct 5 | Plane: Improper validation allows arbitrary modification of API token rate limits Affected: < 1.4.0 |
| CVE-2025-55203 | 5.4 | Aug 15 | Plane Stored XSS in Add Work Item Functionality Affected: < 0.28.0 |
| CVE-2025-21616 | 5.4 | Jan 6 | Plane has a Cross-site scripting (XSS) via SVG image upload Affected: < 0.23 |
| CVE-2026-102988 | 5.3 | Oct 13 | Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) Affected: < 1.4.0 |
| CVE-2026-104956 | 5.3 | Oct 5 | Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle) Affected: < 1.4.0 |
| CVE-2026-104963 | 4.3 | Oct 5 | Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member Affected: < 1.4.0 |
| CVE-2026-104894 | 4.3 | Oct 5 | Plane: Cross-Tenant Module Issue Linking via IDOR Affected: < 1.4.0 |
| CVE-2026-86174 | 4.3 | Sep 5 | Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board Affected: through 1.4.2 |
| CVE-2026-27949 | 4.3 | Apr 7 | Plane Exposes User Email (PII and part of credential) in GET Parameter Affected: < 1.3.0 |
| CVE-2025-69284 | 4.3 | Jan 2 | In plane.io, a Guest User to a Workspace can still be able to see list of members Affected: < 1.2.0 |
| CVE-2025-48070 | 4.3 | May 21 | Plane has insecure permissions in UserSerializer Affected: < 0.23 |