Skip to content
OpenAdvisories

Vendor

PunchIn-App

1 known vulnerabilities.

Products

punchin-email 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.1
    CVE-2026-54649

    punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

    punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to …

    PunchIn-App punchin-email