Skip to content
OpenAdvisories

Product · useplunk

plunk

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.5
    CVE-2026-34975 Public exploit

    Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header injection vulnerability was discovered in SESService.ts, where user-supplied values for from.name, subject, custom header keys/values, and attachment filenames were …

    useplunk plunk
  • Critical 9.3
    CVE-2026-32096 Public exploit

    Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an a…

    useplunk plunk