useplunk CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH useplunk CVE published 2026-04-06

CVE-2026-34975

CVE-2026-34975 is a high-severity vulnerability in Plunk, an open-source email platform. An authenticated API user could inject arbitrary email headers by embedding carriage return/line feed characters in user-supplied values, enabling silent email forwarding, reply redirection, or sender spoofing. The fix adds input validation at the schema level to reject any of these fields containing or characters.