CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

EUVD-2026-92481

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960

The project management tool Plane contains an authorization bypass in the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint. Prior to version 1.4.0 , the application fails to enforce project-level access controls for project-bound FileAsset objects. Con...

EUVD-2026-92476

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

SUSE CVE-2026-71886

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify...

SUSE CVE-2026-71887

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding cross-certification signature, in the case where that binding omits a Key Flags subpacket. RFC 9580 sec...

CVE-2026-104892 Plane: Plaintext logging of API token

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

ASUS GT-AC2900 Auth Bypass (CVE-2021-32030)

Exploits CVE-2021-32030 in ASUS GT-AC2900: asustoken null-byte cookie with asusrouter User-Agent grants unauthenticated admin API access. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS GT-AC2900 null-byte auth bypass CVE-2021-32030.""" import json from kittysploit import from...