https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T21:08:23.443194+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-382911 EUVD-2026-382911 2026-10-06T21:08:23.477047+00:00 EUVD-2026-382911 https://cve.radiocsirt.org/vuln/fkie_cve-2026-105641 fkie_cve-2026-105641 2026-10-06T21:08:23.477081+00:00

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0.