CVE-2026-128332

The listmonk application (versions 6.0.0 before 7.0.0-beta.2) is vulnerable to a 2FA bypass via TOTP brute-forcing at the /admin/login/twofa endpoint. The root cause is that the attempt counter resets on every new password login. An attacker with a valid password can repeatedly submit credentials...

EUVD-2026-125045

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, eac...

EUVD-2026-125044

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin...

CVE-2026-128333

The listmonk application, versions 6.0.0 before 7.0.0-beta.2 , contains an authentication bypass vulnerability in the doResetPassword function. The root cause is a missing critical step in the authentication flow where TOTP verification is skipped following a password reset. An attacker capable o...

EUVD-2026-125043

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to...

CVE-2026-128334

The listmonk email marketing system (versions 6.2.0 before 7.0.0-beta.2) is vulnerable to missing authentication in its Azure Bounce Webhook implementation. When no shared secret is configured, unauthenticated attackers can submit forged EmailDeliveryReportReceived events with a Bounced status to...

CVE-2026-34828

CVE-2026-34828 listmonk’s Session Persistence After Password Reset and Password Change Intro I found this issue while reviewing listmonk , an open-source newsletter and mailing list manager, with a simple security question in mind: When a user changes or resets a password, does the application...

GO-2026-6839 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, gotenberg, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

GO-2026-6840 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

GO-2026-6842 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

GO-2026-6838 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, gotenberg, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

GHSA-XGJR-7J9Q-2H4R listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

CVE-2026-118262 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, gotenberg, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

CVE-2026-118260 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

CVE-2026-118261 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

CVE-2026-118264 vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, gotenberg, kube-metrics-adapter-fips, listmonk, perses-fips, perses...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, temporal-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter, temporal-ui-server-fips, kube-metrics-adapter-fips, listmonk...

GO-2025-4239 vulnerabilities

Vulnerabilities for packages: listmonk...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: seaweedfs-fips, hugo-extended, hugo, mattermost, mailpit, mattermost-fips, mailpit-fips, ollama, seaweedfs-operator, rclone, seaweedfs-operator-fips, ollama-fips, listmonk, seaweedfs, hugo-fips, rclone-fips...