plunk vulnerabilities

2 known vulnerabilities in plunk from Useplunk. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  plunk: Improper Verification of Cryptographic Signature

  CVE-2026-42193May 8, 2026Useplunk

  Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning an

• 8.6 High severity

  plunk: Server-Side Request Forgery

  CVE-2026-32096Mar 11, 2026Useplunk

  Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an ar