github.com/knadh/listmonk vulnerabilities (Go)

5 vulnerabilities.

• github.com/knadh/listmonk Go listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials CVE-2026-62361 Fix available 5.5 MediumJuly 15, 2026
• github.com/knadh/listmonk Go listmonk: Active sessions remain valid after password reset and password change CVE-2026-34828 Public exploitFix available 7.1 HighApril 1, 2026
• github.com/knadh/listmonk Go listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVE-2026-21483 Fix available 5.4 MediumJanuary 2, 2026
• github.com/knadh/listmonk Go listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover CVE-2025-58430 8.6 HighSeptember 9, 2025
• github.com/knadh/listmonk Go listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-49136 Fix available 9.1 CriticalJune 9, 2025