CVE-2026-10850 Plane 1.3.1 - Stored XSS in intake issue description_html

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

EUVD-2026-37732

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

CVE-2026-10850: Improper Neutralization of Input During Web Page Generation

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

PT-2026-50428

Name of the Vulnerable Software and Affected Versions Plane CE version 1.3.1 Description A low-privileged project member can submit arbitrary HTML and JavaScript via the description html field. This occurs when creating an intake work item through the 'API v1 intake' endpoint. Recommendations At...

python311-intake-2.0.9-1.1 on GA media (moderate)

python311-intake-2.0.9-1.1 on GA media Announcement ID: openSUSE-SU-2026:10426-1 Rating: moderate Cross-References: CVE-2026-33310 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2026-33310

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

SUSE CVE-2026-33310

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

OPENSUSE-SU-2026:10426-1 python311-intake-2.0.9-1.1 on GA media

These are all security issues fixed in the python311-intake-2.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

ddsapi (>=0.6.0b5, <=0.7.1), gandharva (>=0.0.1, <=0.0.3) +8 more potentially affected by CVE-2026-33310 via intake (>=2.0.0a2, <=2.0.8)

intake PYPI version =2.0.0a2, =0.6.0b5, =0.0.1, =0.2.7a2, =0.2.4a1, =0.6.2rc6, =0.0.1, =0.6.4, =0.18.0, =0.20.2 Source cves: CVE-2026-33310 Source advisory: SNYK:PYTHON-INTAKE-15763544...

Command Injection

Overview intake is a Data catalog, search and load Affected versions of this package are vulnerable to Command Injection via the catalog parsing when the shell syntax is used within parameter default values. An attacker can execute arbitrary commands on the host system by crafting a malicious...

ddsapi (>=0.6.0b5, <=0.7.1), gandharva (>=0.0.1, <=0.0.3) +8 more potentially affected by CVE-2026-33310 via intake (>=2.0.0a2, <=2.0.8)

intake PYPI version =2.0.0a2, =0.6.0b5, =0.0.1, =0.2.7a2, =0.2.4a1, =0.6.2rc6, =0.0.1, =0.6.4, =0.18.0, =0.20.2 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

CVE-2026-33310

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

intake-dal (>=0.1.6, <=0.1.9) potentially affected by CVE-2026-33310 via intake (0.5.4)

intake PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-dal =0.1.6, =0.1.9 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

empiarreader (>=0.0.1, <=0.0.4), gdptools (>=0.0.2.dev0, <=0.0.22.dev0) +3 more potentially affected by CVE-2026-33310 via intake (0.6.8)

intake PYPI version 0.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - empiarreader =0.0.1, =0.0.2.dev0, =2021.1.0a1, =0.1.0, =0.1.2 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

intake-sqlite (>=0.1.0, <=0.1.2), rubicon-ml (>=0.3.4, <=0.3.7) potentially affected by CVE-2026-33310 via intake (0.6.5)

intake PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - intake-sqlite =0.1.0, =0.3.4, =0.3.7 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

bluesky-cartpole (0.1.0) potentially affected by CVE-2026-33310 via intake (0.6.0)

intake PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - bluesky-cartpole 0.1.0 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

PYSEC-2026-2185

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell, the command ma...

hypycube (0.0.0a0) potentially affected by CVE-2026-33310 via intake (0.5.5)

intake PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - hypycube 0.0.0a0 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...

apsbits (>=1.0.0rc2, <=2.0.4), apstools (>=1.6.5rc3, <=1.8.0rc1) +34 more potentially affected by CVE-2026-33310 via intake (0.6.4)

intake PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - apsbits =1.0.0rc2, =1.6.5rc3, =1.1.0, =0.8.0, =0.1.0, =1.10.5, =0.1.1, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.1, =0.1.0, =0.1.3 and more Source cves:...

climakitae (>=1.0.0, <=1.0.1), climakitaegui (1.0.1) +2 more potentially affected by CVE-2026-33310 via intake (0.6.6)

intake PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on intake and may be impacted: - climakitae =1.0.0, =0.3.8, =0.4.3 Source cves: CVE-2026-33310 Source advisory: OSV:PYSEC-2026-2185...