CVE-2026-104956

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

EUVD-2026-92480

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

PT-2026-106022

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group by and sub group by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .order byfield...

EUVD-2020-2547

Malware in sbrugna...

CVE-2020-10082

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

BIT-GITLAB-2020-10082

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

CVE-2020-10082

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

CVE-2020-10082

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

Denial of service

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

CVE-2020-10082

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

CVE-2020-10082

Removed by vendor...

PT-2020-11907 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2 through 12.8.1 Description: A denial of service issue was found, impacting the designs for public issues. Recommendations: For GitLab versions 12.2 through 12.8.1, update to a version that contains a fix for this issue to...

CVE-2020-10082: Undefined Security Weakness

GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered...

Legal Robot: Improper validation of parameters while creating issues

Heya LegalRobot Team, There is some Improper Access Control on the /Issues/insert endpoint, which leads to three notable vulnerabilities. ----- The first allows attackers to create public issues without undergoing review by setting state: "Open" and public: true. A sample request is given below:...