CVE-2026-34828

CVE-2026-34828 Persistenza delle sessioni di listmonk dopo il reset e la modifica della password Introduzione Ho trovato questo problema mentre esaminavo listmonk , un gestore open-source di newsletter e mailing list, con una semplice domanda di sicurezza in mente: Quando un utente modifica o...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: falcosidekick-ui, temporal, kube-metrics-adapter, kube-metrics-adapter-fips, falcosidekick-ui-fips, temporal-fips, temporal-ui-server-fips, temporal-ui-server, listmonk...

GO-2025-4239 vulnerabilities

Vulnerabilities for packages: listmonk...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: rclone-fips, mailpit, seaweedfs-operator, rclone, hugo, mattermost-fips, seaweedfs, ollama-fips, ollama, hugo-fips, seaweedfs-operator-fips, hugo-extended, mailpit-fips, seaweedfs-fips, mattermost, listmonk...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: rclone-fips, rclone, mattermost-fips, hugo, seaweedfs, seaweedfs-operator-fips, gitlab-workhorse-ce, seaweedfs-operator, seaweedfs-fips, mattermost, listmonk...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, crossplane-provider-aws-efs, crossplane-provider-aws-lightsail-fips, crossplane-provider-aws-ecrpublic-fips, crossplane-provider-aws-sfn, crossplane-provider-aws-cur-fips, crossplane-provider-aws-imagebuilder-fips,...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...

listmonk Admin Authentication / Password Flow Security Assessment Module

This Metasploit auxiliary module is a web application security testing tool designed to evaluate authentication and password management logic in a Listmonk admin panel deployment...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828

CVE-2026-34828 affects listmonk, a standalone self-hosted newsletter manager. A session-management vulnerability in versions 4.1.0 up to, but not including, 6.1.0 allows already-authenticated sessions to remain valid after password reset or password change, enabling an attacker with a valid sessi...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...