CVE-2026-10850

MediumCVSS 5.4/10Last modified Jun 23, 2026

Description

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Jun 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1085015.7ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information CVE-2026-1085023.3ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hook CVE-2026-1085033.3ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access con CVE-2026-1085045.5ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient.CVE-2026-1085053.3ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to o CVE-2026-1085065.5ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call th CVE-2026-108518DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an CVE-2026-108527.5IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer CVE-2026-1085214.7A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file bac CVE-2026-1085228.3A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Lo CVE-2026-1085234.3A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts o CVE-2026-108538.8IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to i