Suggestions search

Dismissed

Filter by:

With package: headplane

Found 2 matching suggestions

View:

Compact

Detailed

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-46558

8.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 2 weeks ago
@LeSuisse dismissed (not in Nixpkgs) 1 month, 2 weeks ago

Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.

References

https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx x_refsource_CONFIRMexploit
https://github.com/makeplane/plane/releases/tag/v1.3.1 x_refsource_MISC

Affected products

plane

==< 1.3.1

Matching in nixpkgs

pkgs.xplanet

Renders an image of the earth or other planets into the X root window

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1
nixos-26.05 1.3.1
- nixos-26.05-small 1.3.1
- nixpkgs-26.05-darwin 1.3.1

pkgs.freeplane

Mind-mapping software

nixos-unstable 1.12.16
- nixpkgs-unstable 1.12.16
- nixos-unstable-small 1.12.16
nixos-26.05 1.12.16
- nixos-26.05-small 1.12.16
- nixpkgs-26.05-darwin 1.12.16

pkgs.headplane

Feature-complete Web UI for Headscale

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2
nixos-26.05 0.6.2
- nixos-26.05-small 0.6.2
- nixpkgs-26.05-darwin 0.6.2

pkgs.m2-planet

PLAtform NEutral Transpiler

nixos-unstable 1.13.1
- nixpkgs-unstable 1.13.1
- nixos-unstable-small 1.13.1
nixos-26.05 1.13.1
- nixos-26.05-small 1.13.1
- nixpkgs-26.05-darwin 1.13.1

pkgs.crossplane

NGINX configuration file parser and builder

nixos-unstable 0.5.8
- nixpkgs-unstable 0.5.8
- nixos-unstable-small 0.5.8
nixos-26.05 0.5.8
- nixos-26.05-small 0.5.8
- nixpkgs-26.05-darwin 0.5.8

pkgs.microplane

CLI tool to make git changes across many repos

nixos-unstable 0.0.37
- nixpkgs-unstable 0.0.37
- nixos-unstable-small 0.0.37
nixos-26.05 0.0.37
- nixos-26.05-small 0.0.37
- nixpkgs-26.05-darwin 0.0.37

pkgs.invoiceplane

Self-hosted open source application for managing your invoices, clients and payments

nixos-unstable 1.7.1
- nixpkgs-unstable 1.7.1
- nixos-unstable-small 1.7.1
nixos-26.05 1.7.1
- nixos-26.05-small 1.7.1
- nixpkgs-26.05-darwin 1.7.1

pkgs.m2-mesoplanet

Macro Expander Saving Our m2-PLANET

nixos-unstable 1.11.0
- nixpkgs-unstable 1.11.0
- nixos-unstable-small 1.11.0
nixos-26.05 1.11.0
- nixos-26.05-small 1.11.0
- nixpkgs-26.05-darwin 1.11.0

pkgs.crossplane-cli

Utility to make using Crossplane easier

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.headplane-agent

Optional sidecar process providing additional features for headplane

nixos-unstable 0.6.3
- nixpkgs-unstable 0.6.3
- nixos-unstable-small 0.6.3
nixos-26.05 0.6.3
- nixos-26.05-small 0.6.3
- nixpkgs-26.05-darwin 0.6.3

pkgs.biplanes-revival

Old cellphone arcade recreated for PC

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1
nixos-26.05 1.2.1
- nixos-26.05-small 1.2.1
- nixpkgs-26.05-darwin 1.2.1

pkgs.planetary_annihilation

Next-generation RTS that takes the genre to a planetary scale

nixos-unstable 62857
- nixpkgs-unstable 62857
- nixos-unstable-small 62857
nixos-26.05 62857
- nixos-26.05-small 62857
- nixpkgs-26.05-darwin 62857

pkgs.perlPackages.MathPlanePath

Points on a path through the 2-D plane

nixos-unstable 129
- nixpkgs-unstable 129
- nixos-unstable-small 129
nixos-26.05 129
- nixos-26.05-small 129
- nixpkgs-26.05-darwin 129

pkgs.perl5Packages.MathPlanePath

Points on a path through the 2-D plane

nixos-unstable 129
- nixpkgs-unstable 129
- nixos-unstable-small 129
nixos-26.05 129
- nixos-26.05-small 129
- nixpkgs-26.05-darwin 129

pkgs.dprint-plugins.g-plane-malva

CSS, SCSS, Sass and Less formatter

nixos-unstable 0.15.1
- nixpkgs-unstable 0.15.1
- nixos-unstable-small 0.15.1
nixos-26.05 0.15.1
- nixos-26.05-small 0.15.1
- nixpkgs-26.05-darwin 0.15.1

pkgs.python313Packages.crossplane

NGINX configuration file parser and builder

nixos-unstable 0.5.8
- nixpkgs-unstable 0.5.8
- nixos-unstable-small 0.5.8
nixos-26.05 0.5.8
- nixos-26.05-small 0.5.8
- nixpkgs-26.05-darwin 0.5.8

pkgs.python314Packages.crossplane

NGINX configuration file parser and builder

nixos-unstable 0.5.8
- nixpkgs-unstable 0.5.8
- nixos-unstable-small 0.5.8
nixos-26.05 0.5.8
- nixos-26.05-small 0.5.8
- nixpkgs-26.05-darwin 0.5.8

pkgs.dprint-plugins.g-plane-markup_fmt

HTML, Vue, Svelte, Astro, Angular, Jinja, Twig, Nunjucks, and Vento formatter

nixos-unstable 0.25.3
- nixpkgs-unstable 0.25.3
- nixos-unstable-small 0.25.3
nixos-26.05 0.25.3
- nixos-26.05-small 0.25.3
- nixpkgs-26.05-darwin 0.25.3

pkgs.dprint-plugins.g-plane-pretty_yaml

YAML formatter

nixos-unstable 0.6.0
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0
nixos-26.05 0.6.0
- nixos-26.05-small 0.6.0
- nixpkgs-26.05-darwin 0.6.0

pkgs.python313Packages.envoy-data-plane

Python dataclasses for the Envoy Data-Plane-API

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.python314Packages.envoy-data-plane

Python dataclasses for the Envoy Data-Plane-API

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3
nixos-26.05 1.0.3
- nixos-26.05-small 1.0.3
- nixpkgs-26.05-darwin 1.0.3

pkgs.python313Packages.planetary-computer

Planetary Computer SDK for Python

nixos-unstable 1.0.0.post0
- nixpkgs-unstable 1.0.0.post0
- nixos-unstable-small 1.0.0.post0
nixos-26.05 1.0.0.post0
- nixos-26.05-small 1.0.0.post0
- nixpkgs-26.05-darwin 1.0.0.post0

pkgs.python314Packages.planetary-computer

Planetary Computer SDK for Python

nixos-unstable 1.0.0.post0
- nixpkgs-unstable 1.0.0.post0
- nixos-unstable-small 1.0.0.post0
nixos-26.05 1.0.0.post0
- nixos-26.05-small 1.0.0.post0
- nixpkgs-26.05-darwin 1.0.0.post0

pkgs.dprint-plugins.g-plane-pretty_graphql

GraphQL formatter

nixos-unstable 0.2.3
- nixpkgs-unstable 0.2.3
- nixos-unstable-small 0.2.3
nixos-26.05 0.2.3
- nixos-26.05-small 0.2.3
- nixpkgs-26.05-darwin 0.2.3

pkgs.azure-cli-extensions.planetarycomputer

Microsoft Azure Command-Line Tools Planetary Computer Extension

nixos-unstable 1.0.0b1
- nixpkgs-unstable 1.0.0b1
- nixos-unstable-small 1.0.0b1
nixos-26.05 1.0.0b1
- nixos-26.05-small 1.0.0b1
- nixpkgs-26.05-darwin 1.0.0b1

pkgs.haskellPackages.amazonka-iot-dataplane

Amazon IoT Data Plane SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

pkgs.python313Packages.greenplanet-energy-api

Async Python library for querying the Green Planet Energy API

nixos-unstable 0.1.10
- nixpkgs-unstable 0.1.10
- nixos-unstable-small 0.1.10
nixos-26.05 0.1.10
- nixos-26.05-small 0.1.10
- nixpkgs-26.05-darwin 0.1.10

pkgs.python314Packages.greenplanet-energy-api

Async Python library for querying the Green Planet Energy API

nixos-unstable 0.1.10
- nixpkgs-unstable 0.1.10
- nixos-unstable-small 0.1.10
nixos-26.05 0.1.10
- nixos-26.05-small 0.1.10
- nixpkgs-26.05-darwin 0.1.10

pkgs.haskellPackages.amazonka-iot-jobs-dataplane

Amazon IoT Jobs Data Plane SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

pkgs.vscode-extensions.gplane.wasm-language-tools

Language support of WebAssembly

nixos-unstable 1.20.0
- nixpkgs-unstable 1.20.0
- nixos-unstable-small 1.20.0
nixos-26.05 1.20.0
- nixos-26.05-small 1.20.0
- nixpkgs-26.05-darwin 1.20.0

pkgs.haskellPackages.amazonka-mediastore-dataplane

Amazon Elemental MediaStore Data Plane SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

Package maintainers

@katexochen Paul Meyer <katexochen0@gmail.com>
@KAction Dmitry Bogatov <KAction@disroot.org>
@LorenzBischof Lorenz Bischof <nix@lorenzbischof.ch>
@selfuryon Sergei Iakovlev <siakovlev@pm.me>
@phanirithvij Phani Rithvij <phanirithvij2000@gmail.com>
@charles-dyfis-net Charles Duffy <charles@dyfis.net>
@StealthBadger747 Erik Parawell <parawell.erik@gmail.com>
@igor-ramazanov Igor Ramazanov <personal@igorramazanov.tech>
@onny Jonas Heinrich <onny@project-insanity.org>
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
@emilytrau Emily Trau <emily+nix@downunderctf.com>
@Artturin Artturi N <artturin@artturin.com>
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
@06kellyjac Jack <hello+nixpkgs@j-k.io>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
@dbirks David Birks <david@birks.dev>
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
@JamieMagee Jamie Magee <jamie.magee@gmail.com>
@daspk04 Pratyush Das <dpratyush.k@gmail.com>
@samestep Sam Estep <sam@samestep.com>
@Lassulus Lassulus <lassulus@gmail.com>

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-40102

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months ago by @06kellyjac Activity log

Created suggestion 2 months ago
@06kellyjac ignored package m2-planet 2 months ago
@06kellyjac dismissed (not in Nixpkgs) 2 months ago

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.