EUVD-2026-92470

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...

PT-2026-106003

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts wi...

UBUNTU-CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

UBUNTU-CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

UBUNTU-CVE-2026-103880

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced ...

PT-2026-106019

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/token id/ allows the user to modify the token's allowed rate limit field without server-side validation or a...

PT-2026-106034

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

PT-2026-106058

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description html through Issue.objects.create... without calling validate html content from nh3. Any authenticated user, including a new user with no workspace memberships, can...

PT-2026-106028

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

PT-2026-106086

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...

PT-2026-106044

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

PT-2026-106190

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

PT-2026-106052

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook task.py performs a separate DNS resolution...

PT-2026-106082

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/project id/join/pk/ uses permission classes = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

CVE-2026-71299: Missing Authentication for Critical Function

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71298: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-105639: Exposure of Sensitive Information to an Unauthorized Actor

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...