Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-08 | 1 | Disclosure1 |
| 2026-05-09 | 2 | Disclosure2 |
| 2026-05-13 | 3 | General3 |
CVE: CVE-2026-42193 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory Plunk is an open-source email platform built on top of AWS SES.
Post summary
The advisory highlights CVE‑2026‑42193 as a critical vulnerability for the Plunk email platform, providing only severity metrics and no further technical or mitigation details.
CVSS 9.1 CRITICAL · CVE-2026-42193 · 9.1 → 0.9.0 CVE: CVE-2026-42193 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text lists the CVE, its CVSS score and severity, with no further context on exploitation or mitigation.
https://lyrie.ai/research/research/cve-2026-42193-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post provides only a link and generic tags, offering no substantive details about CVE‑2026‑42193.
CVE-2026-42193 Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unaut… https://www.cve.org/CVERecord?id=CVE-2026-42193
Post summary
CVE‑2026‑42193 has been disclosed for Plunk; the '/webhooks/sns' endpoint accepts unauthenticated Amazon SNS notifications prior to version 0.9.0, indicating a significant exposure.
CVE-2026-42193 Unauthenticated SNS Webhook Spoofing in Plunk Prior to Version 0.9.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42193
Post summary
The text announces CVE‑2026‑42193 as an unauthenticated SNS webhook spoofing issue in Plunk before version 0.9.0, but provides no further technical or mitigation details.
🚨 CRITICAL — CVE-2026-42193 Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint acce… CVSS 9.1 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-42193 #AWS #CyberSecurity #InfoSec
Post summary
A new critical vulnerability, CVE-2026-42193, affects the /webhooks/sns endpoint of Plunk (pre‑0.9.0) with a CVSS score of 9.1, and no patch is currently available.