Repository navigation
Security: useplunk/plunk
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Cross-site request forgery on dashboard account routes allows project reset and API key regenerationGHSA-9g9f-4cpj-p2jv published
Nov 11, 2026 by driaugHigh -
SNS webhook accepts messages from topics outside the installation's AWS accountGHSA-mwh5-6jhc-j52c published
Nov 11, 2026 by driaugHigh -
Event data keys from the public tracking endpoint are compiled as regular expressions, letting anonymous visitors stall or hang the API in PlunkGHSA-2972-cw4f-hj5r published
Oct 13, 2026 by driaugHigh -
SSRF Guard Bypass via IPv6 Transition Addresses in Webhook Execution ServiceGHSA-xmqh-qfqq-4883 published
Nov 11, 2026 by driaugHigh -
Cross-tenant workflow trigger via unsanitized contactId in POST /events/trackGHSA-v958-vf5v-cxjr published
Nov 11, 2026 by driaugHigh -
Stored XSS in campaign viewGHSA-mjqc-qrv3-24hq published
Apr 20, 2026 by driaugModerate -
SNS webhook forgeryGHSA-9792-w86v-gx53 published
Apr 20, 2026 by driaugCritical -
CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headersGHSA-2mvm-rg5v-7hfq published
Mar 31, 2026 by driaugHigh -
Stored Cross-Site Scripting (XSS) via SVG File UploadGHSA-69jg-7493-cx5x published
Mar 10, 2026 by driaugModerate -
SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/snsGHSA-xpqg-p8mp-7g44 published
Mar 5, 2026 by driaugCritical
Learn more about advisories related to useplunk/plunk in the GitHub Advisory Database