How many CVEs have patched get?

13 published CVEs changed get in makeplane/plane, in 29 distinct patches totalling 118 changed lines, between 2026 and 2026.

How does get compare to the rest of makeplane/plane?

makeplane/plane has 48 CVEs with a located fix in total; 13 of them changed get.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

get in makeplane/plane: Patched by 13 CVEs

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

CVE-2026-102986 · apps/api/plane/space/views/asset.py · lines 45–48 · +2 −1

High · CVSS 8.1

EPSS 0.4%2026-10-14

Plane: Unauthenticated Workspace Invitation Token Leakage

CVE-2026-102981 · apps/api/plane/app/views/workspace/invite.py · lines 256–259 · +4 −1

Medium · CVSS 6.5

EPSS 0.2%2026-10-13

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVE-2026-102988 · apps/api/plane/api/views/cycle.py · line 858 · +1 −1

Medium · CVSS 5.3

EPSS 0.2%2026-10-13

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVE-2026-102988 · apps/api/plane/api/views/module.py · lines 601–807 · +2 −2 in 2 hunks

Medium · CVSS 5.3

EPSS 0.2%2026-10-13

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVE-2026-102988 · apps/api/plane/app/views/user/base.py · lines 388–392 · +5 −1

Medium · CVSS 5.3

EPSS 0.2%2026-10-13

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVE-2026-102988 · apps/api/plane/app/views/workspace/user.py · lines 394–398 · +5 −1

Medium · CVSS 5.3

EPSS 0.2%2026-10-13

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639 · apps/api/plane/app/views/workspace/invite.py · lines 256–259 · +4 −1

Critical · CVSS 9.8

EPSS 0.4%2026-10-05

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

CVE-2026-105635 · apps/api/plane/app/views/project/invite.py · line 256 · +1 −1

High · CVSS 7.4

EPSS 0.4%2026-10-05

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

CVE-2026-105633 · apps/api/plane/app/views/issue/attachment.py · line 176 · +1 −1

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/app/views/asset/v2.py · lines 464–469 · +6 −0

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/space/views/asset.py · lines 45–48 · +2 −1

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

CVE-2026-105630 · apps/api/plane/api/views/asset.py · lines 447–459 · +11 −2

High · CVSS 8.7

EPSS 0.2%2026-10-05

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

CVE-2026-105630 · apps/api/plane/app/views/asset/v2.py · lines 465–477 · +11 −2

High · CVSS 8.7

EPSS 0.2%2026-10-05

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

CVE-2026-105630 · apps/api/plane/space/views/asset.py · lines 63–75 · +11 −2

High · CVSS 8.7

EPSS 0.2%2026-10-05

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975 · apps/api/plane/space/views/asset.py · lines 45–48 · +2 −1

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/space/views/asset.py · lines 45–48 · +2 −1

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

CVE-2026-104964 · apps/api/plane/app/views/workspace/user.py · lines 282–291 · +7 −2

Medium · CVSS 6.8

EPSS 0.3%2026-10-05

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

CVE-2026-104963 · apps/api/plane/app/views/workspace/cycle.py · lines 24–29 · +6 −1

Medium · CVSS 4.3

EPSS 0.2%2026-10-05

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

CVE-2026-104963 · apps/api/plane/app/views/workspace/module.py · lines 24–29 · +6 −1

Medium · CVSS 4.3

EPSS 0.2%2026-10-05

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

CVE-2026-104960 · apps/api/plane/app/views/asset/v2.py · lines 464–469 · +6 −0

Medium · CVSS 6.5

EPSS 0.3%2026-10-05

get

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track makeplane/plane CVEs