{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-26T12:09:16.035Z", "lastRun": "2026-10-26T12:01:43.907Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "makeplane" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-105641", "url": "https://cveboard.org/i/cve-2026-105641", "urlPt": "https://cveboard.org/pt/i/cve-2026-105641", "json": "https://cveboard.org/i/cve-2026-105641.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-07T21:40:19.044Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105641" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.0046, "percentile": 0.39623, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105641" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:12:33.062Z", "updatedAt": "2026-10-05T18:12:33.062Z" }, { "id": "cve-2026-105640", "url": "https://cveboard.org/i/cve-2026-105640", "urlPt": "https://cveboard.org/pt/i/cve-2026-105640", "json": "https://cveboard.org/i/cve-2026-105640.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365", "tag": "exploit" } ], "cwes": [ { "id": "CWE-287", "name": "Improper Authentication" }, { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-05T18:32:52.620Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105640" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.00384, "percentile": 0.32163, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105640" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:11:35.680Z", "updatedAt": "2026-10-05T18:11:35.680Z" }, { "id": "cve-2026-105639", "url": "https://cveboard.org/i/cve-2026-105639", "urlPt": "https://cveboard.org/pt/i/cve-2026-105639", "json": "https://cveboard.org/i/cve-2026-105639.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, { "id": "CWE-287", "name": "Improper Authentication" }, { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-06T14:37:11.181Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105639" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.00394, "percentile": 0.33281, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105639" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:10:35.787Z", "updatedAt": "2026-10-05T18:10:35.787Z" }, { "id": "cve-2026-105638", "url": "https://cveboard.org/i/cve-2026-105638", "urlPt": "https://cveboard.org/pt/i/cve-2026-105638", "json": "https://cveboard.org/i/cve-2026-105638.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq", "tag": "exploit" } ], "cwes": [ { "id": "CWE-307", "name": "Improper Restriction of Excessive Authentication Attempts" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-05T18:43:46.990Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105638" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.00384, "percentile": 0.32163, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105638" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:09:35.649Z", "updatedAt": "2026-10-05T18:09:35.649Z" }, { "id": "cve-2026-105637", "url": "https://cveboard.org/i/cve-2026-105637", "urlPt": "https://cveboard.org/pt/i/cve-2026-105637", "json": "https://cveboard.org/i/cve-2026-105637.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp", "tag": "exploit" } ], "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-05T19:09:42.896Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105637" ], "ghsa": null, "cvss": { "score": 9.6, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.00319, "percentile": 0.24675, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105637" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:04:02.780Z", "updatedAt": "2026-10-05T18:04:02.780Z" }, { "id": "cve-2026-105636", "url": "https://cveboard.org/i/cve-2026-105636", "urlPt": "https://cveboard.org/pt/i/cve-2026-105636", "json": "https://cveboard.org/i/cve-2026-105636.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "makeplane plane", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "makeplane", "product": "plane", "defaultStatus": "unknown", "versions": [ { "version": "< 1.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h", "tag": "exploit" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-07T21:39:13.833Z" }, "fix": "none", "tags": [ "makeplane" ], "cves": [ "CVE-2026-105636" ], "ghsa": null, "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub_M" }, "epss": { "percentage": 0.00427, "percentile": 0.36719, "asOf": "2026-10-25", "by": "FIRST" }, "packages": [], "vendor": "makeplane", "product": "plane", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105636" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-05T18:02:53.127Z", "updatedAt": "2026-10-05T18:02:53.127Z" } ], "tag": { "tag": "makeplane", "name": "makeplane", "kev": null } }