Plane, an open-source project management tool, had a vulnerability prior to version 1.4.0 where its project update endpoint authorized users based on the workspace slug but loaded projects globally by UUID without workspace binding. This allowed administrators of one workspace to modify projects in other workspaces if they knew the project UUID, violating tenant isolation. The issue was fixed in version 1.4.0.
CVE-2026-78412 is an authorization bypass vulnerability in Rapid7 Velociraptor's WatchEvent gRPC API. The API allows specifying the OrgId to stream events from, but the server incorrectly checks permissions against the caller's organization rather than the requested one. This flaw enables a user with API access in one organization to read events from another organization without authorization. The vulnerability affects Velociraptor versions prior to 0.77.3. The CVSS score is 4.9, indicating medium severity.
Plane, an open-source project management tool, had a vulnerability prior to version 1.4.0 where certain API endpoints exposed sensitive information from private projects to any authenticated workspace member. Specifically, the GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ endpoints returned data without verifying project membership, allowing unauthorized enumeration of project details. This issue was fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the endpoint, but its SAFE_METHODS branch checks only whether the caller is an active ProjectMember of any project in the workspace and does not bind the check to view.project_id. The view then filters solely by the project_id supplied in the URL. Consequently, any authenticated user who belongs to one project in a workspace, including a Guest, can read the roster of another private project in the same workspace. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has an authorization vulnerability prior to version 1.4.0. The WorkspaceOwnerPermission check does not verify if a user is active, allowing deactivated users to retain workspace owner access. This issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs to the same workspace, is not a member of the victim's secret project, and knows the target asset UUID can receive a 302 redirect to a signed download URL. The intended project-scoped route for the same asset correctly returns 403. Confirmed affected project-bound asset types are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. This bypass exposes private file content protected by the secret project boundary. This issue is fixed in 1.4.0.
CVE-2026-104956 is a medium severity vulnerability in the open-source project management tool Plane prior to version 1.4.0. The unauthenticated public issues endpoint improperly handles the group_by and sub_group_by query parameters by passing them without validation to ORM field operations. This allows an anonymous attacker to trigger unhandled errors causing HTTP 500 responses or perform blind ORM relational path traversals. The vulnerability does not disclose data directly and is fixed in Plane version 1.4.0.
A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Plane, an open-source project management tool, has a privilege management vulnerability prior to version 1.4.0. A Project Member with role 15 can exploit insufficient validation in the project-member update API endpoint to promote a Project Guest (role 5) to Member without requiring Project Admin approval. This unauthorized role escalation grants additional project capabilities and bypasses governance controls. The issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where authenticated users can modify API token rate limits without server-side validation. This allows users to arbitrarily increase their allowed_rate_limit, bypassing intended API rate-limiting controls and potentially causing resource exhaustion. The issue is fixed in version 1.4.0.
auto-changelog versions before 2.6.1 merge configuration from inside the target repository, including untrusted files, into their options. This allows execution of attacker-controlled code via the handlebarsSetup option, loading malicious modules via plugins, git argument injection, arbitrary file writes, and outbound requests to attacker-chosen URLs. Version 2.6.1 mitigates this by treating in-repository configuration as untrusted and refusing to run if unsafe options are set unless overridden by a specific flag.
Eclipse Che versions 7.29.0 and later contain a vulnerability in the GET /api/scm/resolve and POST /api/factory/resolver endpoints that allows authenticated users to supply attacker-controlled URLs to a fetch function without proper scheme or host validation. This enables reading arbitrary local files, accessing internal HTTP services and cloud metadata endpoints, and forwarding stored SCM personal access tokens to attacker-controlled hosts. The vulnerability also allows exfiltration of SCM personal access tokens via malicious devfiles. No fix is currently available.
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
CVE-2026-104891 is an authentication bypass vulnerability in the douglasborthwick-crypto mppx-condition-gate packages. These packages improperly grant free access to payment routes by trusting a client-supplied wallet address without verifying control over that wallet. This allows attackers to name any qualifying wallet address and bypass payment. All published versions of both packages are affected. Fixed versions will require proof of wallet control before granting free access. Until patched, removing the condition gate or ensuring prior wallet binding is recommended.
KunstmaanBundlesCMS MediaBundle had a vulnerability allowing authenticated backend users to upload files with dangerous extensions that bypassed a case-sensitive blacklist. This allowed execution of uploaded PHP files via the web server, leading to remote code execution. The issue was fixed in version 7.3.2 by normalizing file extensions before checking, expanding the blacklist, and adding an allow-list option. Existing files on disk with executable extensions should be audited. Workarounds include configuring the web server to prevent script execution in the upload directory.
Denmark's Central Population Register (CPR) experienced a data breach exposing personal information of approximately 8.8 million individuals. The breach involves sensitive registry data but specific technical details and exploited vulnerabilities are not provided. No patch or remediation details are available from the input data. The incident affects a large portion of the Danish population, but no information on targeted countries beyond Denmark is given.
CVE-2026-105329 is a code injection vulnerability in TallCMS affecting versions 4.0 through 4.8.0. The flaw exists in an unspecified function within the PluginManager component, specifically in the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php. This vulnerability allows remote attackers to execute code via crafted input. A patch identified by commit fdc18f4c6a36134f8986ca1d7e4e97092e3deb93 is available to address this issue. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No known exploits are currently reported in the wild.
The LearnPress plugin for WordPress up to version 4.4.9.1 has a stored cross-site scripting (XSS) vulnerability. Authenticated users with the Instructor role can inject malicious scripts via quiz question hint and explanation fields. These scripts execute in the context of students taking the quiz, potentially compromising their sessions.
