CVE-2026-104977 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected...

EUVD-2026-92535

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected...

CVE-2026-104977

The project management tool Plane contains a Server-Side Request Forgery (SSRF) vulnerability in its work-item link unfurling functionality. The issue persists in versions prior to 1.4.0 because the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw remained incomplete in the 1.3.1 GA release. Specif...

CVE-2026-104977 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected...

CVE-2026-104977 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976

The project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The application fails to reject hosts that resolve to private or internal IP addresses when validating the GITEA_HOST variable. Specifically, four outbound requests in the Gitea OA...

EUVD-2026-92533

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

EUVD-2026-92526

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-104973 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-104973

The open-source project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) via a DNS rebinding bypass. Prior to version 1.4.0 , the application only validated webhook IP addresses during creation in apps/api/plane/app/serializers/webhook.py. However, the delivery task in ...

CVE-2026-104973 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-104973 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

[SECURITY] [DLA 4823-1] roundcube security update

Debian LTS Advisory DLA-4823-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 05, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.6.5+dfsg-1+deb12u12 CVE ID : not yet available Debian Bug : 1146838 Multiple vulnerabilities were discovered ...

CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-12171

Versions of auto-changelog prior to 2.6.1 are vulnerable to code execution , argument injection , path traversal , and SSRF because they process untrusted configuration from within the target repository (e.g., .auto-changelog or package.json). Specifically, the handlebarsSetup option is passed to...