Vendor security profile

makeplane

Product portfolio, patch evidence and exploitation signals in a single security scorecard

The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page

Total CVEs39

Critical6

CISA KEV0

Public exploit28

Patch rate%0

Avg. CVSS7.5

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

Kas

Ara

Oca

Şub

Mar

Nis

May

Haz

Tem

Ağu

Eyl

Eki

CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

39toplam CVE

Critical6 (15%)

High20 (51%)

Medium13 (33%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

Verified patch

0 records

CISA KEV

0 records

%72

Public exploit

28 records

0Patch available

0Partial

0Workaround

0Vendor: no patch

39Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all

9.8

CVE-2026-105641

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

9.1

CVE-2026-105640

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

9.8

CVE-2026-105639

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

9.1

CVE-2026-105638

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

9.6

CVE-2026-105637

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

9.9

CVE-2026-105636

Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

7.4

CVE-2026-105635

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

8.1

CVE-2026-105634

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

7.1

CVE-2026-105633

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

8.7

CVE-2026-105632

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

VendormakeplaneProductplane

Patch status unknownEPSS %06 d ago

makeplane

12-month vulnerability rate

CVE severity distribution

Patch and exploitation view

Latest vulnerabilities

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration