CVE-2026-34828

CVE-2026-34828 listmonk’s Session Persistence After Password Reset and Password Change Intro I found this issue while reviewing listmonk , an open-source newsletter and mailing list manager, with a simple security question in mind: When a user changes or resets a password, does the application...

CVE-2026-118261 vulnerabilities

Vulnerabilities for packages: perses, kube-metrics-adapter-fips, perses-fips, temporal-ui-server-fips, listmonk, falcosidekick-ui, falcosidekick-ui-fips, kube-metrics-adapter, temporal-fips, temporal-ui-server, temporal...

CVE-2026-118260 vulnerabilities

Vulnerabilities for packages: perses, kube-metrics-adapter-fips, perses-fips, temporal-ui-server-fips, listmonk, falcosidekick-ui, falcosidekick-ui-fips, kube-metrics-adapter, temporal-fips, temporal-ui-server, temporal...

CVE-2026-118262 vulnerabilities

Vulnerabilities for packages: perses, gotenberg, kube-metrics-adapter-fips, perses-fips, temporal-ui-server-fips, falcosidekick-ui, listmonk, falcosidekick-ui-fips, kube-metrics-adapter, temporal-fips, temporal-ui-server, temporal...

CVE-2026-118264 vulnerabilities

Vulnerabilities for packages: perses, gotenberg, kube-metrics-adapter-fips, perses-fips, temporal-ui-server-fips, falcosidekick-ui, listmonk, falcosidekick-ui-fips, kube-metrics-adapter, temporal-fips, temporal-ui-server, temporal...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter-fips, temporal-ui-server-fips, listmonk, falcosidekick-ui, falcosidekick-ui-fips, kube-metrics-adapter, temporal-fips, temporal-ui-server, temporal...

GO-2025-4239 vulnerabilities

Vulnerabilities for packages: listmonk...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: seaweedfs, seaweedfs-operator, rclone, rclone-fips, listmonk, mattermost-fips, ollama, hugo-fips, mailpit, mailpit-fips, hugo-extended, hugo, seaweedfs-fips, ollama-fips, mattermost, seaweedfs-operator-fips...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: seaweedfs, seaweedfs-operator, seaweedfs-operator-fips, rclone, mattermost-fips, listmonk, seaweedfs-fips, hugo, rclone-fips, mattermost, gitlab-workhorse-ce...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecr, crossplane-provider-aws-appautoscaling-fips, crossplane-provider-aws-deploy-fips, crossplane-provider-aws-licensemanager, crossplane-provider-aws-sesv2, crossplane-provider-aws-lightsail-fips, crossplane-provider-aws-dataexchange-fips,...

SUSE CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

Listmonk Installer Exposure Detection

Listmonk is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Listmonk is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...

CVE-2026-62361: Improper Neutralization of Special Elements used in an SQL Command

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...