All CVEs — page 321 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw is an incomplete Server-Side Request Forgery (SSRF) vulnerability in Plane's work-item link unfurling feature, where authenticated users can make the server fetch data from internal targets like cloud metadata services. This allows attackers to access sensitive internal resources that should be protected from external access.
The flaw allows a deactivated user to log in with existing credentials, silently reactivate their account, and potentially gain unauthorized access. This matters because it bypasses account deactivation and could lead to unauthorized access and data breaches.
The Plane project management tool had a DNS rebinding vulnerability in webhook delivery that allowed attackers to bypass SSRF protections by resolving IP addresses during delivery rather than at creation time. This could enable remote code execution or data exfiltration through manipulated webhooks.
The flaw allows cross-workspace asset duplication and unauthorized access to workspace assets, posing a high risk to project management tool security.
The flaw is a PHP object injection vulnerability in FacturaScripts before version 2026.7, allowing attackers to execute arbitrary code and delete critical files, leading to denial of service and potential application reinstall hijack.
The flaw allows an authenticated user to inject unauthorized executable plugins into the privileged control plane namespace, leading to arbitrary code execution.
The auto-changelog tool allows untrusted repository configuration to execute arbitrary code with the privileges of the running process, enabling remote code execution through attacker-controlled configuration files. This vulnerability is particularly dangerous in CI/CD workflows where untrusted code is checked out and processed.
The flaw allows two unauthenticated users to create separate admin accounts, granting both unrestricted instance administration, due to the lack of transactional and locking mechanisms.