How many CVEs have patched patch?

13 published CVEs changed patch in makeplane/plane, in 11 distinct patches totalling 53 changed lines, between 2024 and 2026.

How does patch compare to the rest of makeplane/plane?

makeplane/plane has 48 CVEs with a located fix in total; 13 of them changed patch.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

patch in makeplane/plane: Patched by 13 CVEs

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

CVE-2026-102986 · apps/api/plane/space/views/asset.py · lines 144–145 · +2 −2

High · CVSS 8.1

EPSS 0.4%2026-10-14

Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

CVE-2026-105636 · apps/api/plane/app/views/webhook/base.py · line 84 · +1 −1

Critical · CVSS 9.9

EPSS 0.4%2026-10-05

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

CVE-2026-105633 · apps/api/plane/app/views/issue/attachment.py · lines 207–229 · +5 −3 in 2 hunks

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/app/views/asset/v2.py · lines 420–425 · +6 −0

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/space/views/asset.py · lines 144–145 · +2 −2

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

CVE-2026-105628 · apps/api/plane/app/views/webhook/base.py · line 84 · +1 −1

High · CVSS 7.6

EPSS 0.3%2026-10-05

Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

CVE-2026-104977 · apps/api/plane/app/views/webhook/base.py · line 84 · +1 −1

High · CVSS 7.7

EPSS 0.3%2026-10-05

Plane: SSRF in Gitea OAuth

CVE-2026-104976 · apps/api/plane/app/views/webhook/base.py · line 84 · +1 −1

High · CVSS 8.7

EPSS 0.2%2026-10-05

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975 · apps/api/plane/space/views/asset.py · lines 144–145 · +2 −2

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

CVE-2026-104973 · apps/api/plane/app/views/webhook/base.py · line 84 · +1 −1

High · CVSS 7.6

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/app/views/asset/v2.py · line 402 · +1 −0

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/space/views/asset.py · lines 144–145 · +2 −2

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

CVE-2026-104960 · apps/api/plane/app/views/asset/v2.py · lines 420–425 · +6 −0

Medium · CVSS 6.5

EPSS 0.3%2026-10-05

Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch

CVE-2026-27705 · apps/api/plane/app/views/asset/v2.py · line 582 · +1 −1

Medium · CVSS 4.9

EPSS 0.4%2026-02-25

CVE-2024-31461

CVE-2024-31461 · apiserver/plane/app/views/importer.py · line 257 · +1 −3

Critical · CVSS 9.1

EPSS 0.7%2024-04-10

patch

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track makeplane/plane CVEs