CVE-2026-34828

CVE-2026-34828 Persistencia de sesión de listmonk tras el restablecimiento y cambio de contraseña Introducción Encontré este problema al revisar listmonk , un gestor de boletines y listas de correo de código abierto, con una simple pregunta de seguridad en mente: Cuando un usuario cambia o...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: temporal-ui-server, temporal-ui-server-fips, kube-metrics-adapter, listmonk, temporal, temporal-fips, falcosidekick-ui-fips, kube-metrics-adapter-fips, falcosidekick-ui...

GO-2025-4239 vulnerabilities

Vulnerabilities for packages: listmonk...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: ollama-fips, mailpit, mailpit-fips, mattermost-fips, seaweedfs, seaweedfs-operator, hugo-extended, rclone-fips, listmonk, ollama, seaweedfs-operator-fips, hugo-fips, seaweedfs-fips, mattermost, rclone, hugo...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: mattermost-fips, seaweedfs, seaweedfs-operator, rclone-fips, listmonk, seaweedfs-operator-fips, seaweedfs-fips, mattermost, gitlab-workhorse-ce, rclone, hugo...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-beta-container-fips, crossplane-provider-aws-configservice, crossplane-provider-family-gcp-config, crossplane-provider-aws-budgets, crossplane-provider-aws-datasync, crossplane-provider-aws-iot, crossplane-provider-aws-ecrpublic-fips,...

SUSE CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361: Improper Neutralization of Special Elements used in an SQL Command

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk

listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...

listmonk Admin Authentication / Password Flow Security Assessment Module

This Metasploit auxiliary module is a web application security testing tool designed to evaluate authentication and password management logic in a Listmonk admin panel deployment...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...