1322262 matches found
CVE-2026-104978
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
[SECURITY] [DSA 6543-1] libreoffice security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...
EUVD-2026-92578
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...
EUVD-2026-92701
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...
CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...
CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...
EUVD-2026-92700
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...
CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...
CVE-2026-105635
The open-source project management tool Plane is vulnerable to unauthorized project joining in versions prior to 1.4.0 . The ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ incorrectly uses permission_classes = [AllowAny], allowing unauthenticated callers to ret...
EUVD-2026-92546
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...
CVE-2026-105631
The open-source project management tool Plane is vulnerable to unauthorized data disclosure in versions prior to 1.4.0 . The WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get endpoints fail to verify if a user has membership in the specific project containing a FileAsset recor...
CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...
CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...
EUVD-2026-92544
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...
CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...
CVE-2025-32044
CVE-2025-32044 — Moodle Unauthenticated REST API User Data Exposure Stack Trace Args Leak → Names, Emails, Password Hashes Overview CVE-2025-32044 is a high-severity CVSS 7.5 unauthenticated information disclosure vulnerability in Moodle LMS 4.5.0 through 4.5.2. The vulnerability lies in Moodle's...
CVE-2026-63268
A flaw was found in LibreOffice Calc. An attacker could craft a spreadsheet document with an external database link that points to local text files. If a user opens the malicious document, the application automatically reads the local file contents into the sheet, leading to unauthorized...
[SECURITY] [DLA 4823-1] roundcube security update
Debian LTS Advisory DLA-4823-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 05, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.6.5+dfsg-1+deb12u12 CVE ID : not yet available Debian Bug : 1146838 Multiple vulnerabilities were discovered ...
GHSA-4WWP-F6GW-6QM5 SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
Summary: IsForbiddenAbsPath only blocks conf/conf.json by exact match. The TLS private key conf/key.pem and CA private key conf/ca.key live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST /api/file/getFile. Root cause...
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
Summary: IsForbiddenAbsPath only blocks conf/conf.json by exact match. The TLS private key conf/key.pem and CA private key conf/ca.key live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST /api/file/getFile. Root cause...