Useplunk vulnerabilities
We track 2 vulnerabilities in Useplunk products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
2vulnerabilities
1critical
1high
0exploited
8.8average CVSS score
Latest Useplunk vulnerabilities
- 9.1 Critical severity
plunk: Improper Verification of Cryptographic Signature
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning an
- 8.6 High severity
plunk: Server-Side Request Forgery
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an ar