Skip to content
OpenAdvisories

Vendor

useplunk

5 known vulnerabilities.

Products

plunk 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-42193

    Plunk: SNS webhook forgery

    Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning a…

    useplunk plunk
  • Critical 9.3
    CVE-2026-32096 Public exploit

    Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an a…

    useplunk plunk