Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,279 results · page 18 of 346
Oct 5, 2026Immich is a high-performance self-hosted photo and video management solution.CVE-2026-105764 · Other software · immich-app · reported by GitHubHigh 7.7
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled <image href> values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Twenty is an open-source CRM (customer relationship management) platform.CVE-2026-105763 · Other software · twentyhq · reported by GitHubCritical 9.6
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
- Product
- twenty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105683 · Other software · TryGhost · reported by GitHubLow 3.8
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105682 · Other software · TryGhost · reported by GitHubLow 2.7
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105681 · Other software · TryGhost · reported by GitHubMedium 6.5
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105680 · Other software · TryGhost · reported by GitHubMedium 6.5
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105679 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105678 · Other software · TryGhost · reported by GitHubMedium 4.3
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105677 · Other software · TryGhost · reported by GitHubHigh 7.2
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105676 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105675 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105652 · Other software · TryGhost · reported by GitHubLow 3.1
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105651 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105650 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105649 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105648 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105647 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105646 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105645 · Other software · TryGhost · reported by GitHubMedium 4.9
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105644 · Other software · TryGhost · reported by GitHubMedium 6.8
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105643 · Other software · TryGhost · reported by GitHubHigh 7.3
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new security.embedPreviewUrl configuration option at its default value. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Ghost is a Node.js content management system.CVE-2026-105642 · Other software · TryGhost · reported by GitHubHigh 8.8
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105641 · Other software · makeplane · reported by GitHubCritical 9.8
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105640 · Other software · makeplane · reported by GitHubCritical 9.1
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105639 · Other software · makeplane · reported by GitHubCritical 9.8
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105638 · Other software · makeplane · reported by GitHubCritical 9.1
Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105637 · Other software · makeplane · reported by GitHubCritical 9.6
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105636 · Other software · makeplane · reported by GitHubCritical 9.9
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105635 · Other software · makeplane · reported by GitHubHigh 7.4
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105634 · Other software · makeplane · reported by GitHubHigh 8.1
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.CVE-2026-105386 · Other software · onetwothreeneth · reported by VulDBMedium 5.5
A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105633 · Other software · makeplane · reported by GitHubHigh 7.1
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105632 · Other software · makeplane · reported by GitHubHigh 8.7
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace: a low-privilege member can read and modify confidential data in every private project. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105631 · Other software · makeplane · reported by GitHubHigh 7.5
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105630 · Other software · makeplane · reported by GitHubHigh 8.7
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105629 · Other software · makeplane · reported by GitHubHigh 7.1
Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-105628 · Other software · makeplane · reported by GitHubHigh 7.6
Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.CVE-2026-105385 · Other software · onetwothreeneth · reported by VulDBMedium 5.5
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipulation of the argument transaction_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.CVE-2026-105384 · Other software · UNION · reported by VulDBMedium 5.5
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104979 · Other software · makeplane · reported by GitHubHigh 8.7
Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104978 · Other software · makeplane · reported by GitHubHigh 8.2
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email address. When a pending invitation targets an email address that has not registered with Plane, an attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation. The attacker-controlled account is then added to the target workspace and project. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104977 · Other software · makeplane · reported by GitHubHigh 7.7
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104976 · Other software · makeplane · reported by GitHubHigh 8.7
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104975 · Other software · makeplane · reported by GitHubHigh 7.1
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and project_id and workspace__slug scoping to the asset endpoints in that file. The Spaces app in plane/space/views/asset.py serves related public-board operations under /api/public/ but was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or project_id constraint. An attacker can therefore read, overwrite, or restore assets across projects and workspaces. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104974 · Other software · makeplane · reported by GitHubHigh 8.1
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104973 · Other software · makeplane · reported by GitHubHigh 7.6
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104971 · Other software · makeplane · reported by GitHubHigh 8.5
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.CVE-2026-105383 · Other software · onetwothreeneth · reported by VulDBMedium 5.5
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.CVE-2026-105382 · Other software · onetwothreeneth · reported by VulDBMedium 5.5
A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HospitalManagementSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Plane is an open-source project management tool.CVE-2026-104970 · Other software · makeplane · reported by GitHubHigh 8.1
Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses can both observe that no instance administrator exists, create separate User and InstanceAdmin rows, and receive sessions with instance-admin authority. This allows an attacker to share unrestricted instance administration with the legitimate operator. This issue is fixed in 1.4.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.