Vulnerabilities

TI-2026-27072 CVE-2026-34828 · GHSA-h5j9-cvrw-v5qh

listmonk: Active sessions remain valid after password reset and password change

MEDIUM 64

listmonk is a standalone, self-hosted, newsletter and mailing list manager.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00312 Published 2026-04-02 Fixed in 6.1.0, 1.1.1-0.20260329113754-1b5e8d38c778 CWE-613

TI-2026-26831 CVE-2026-34584

LOW 24

listmonk is a standalone, self-hosted, newsletter and mailing list manager.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00178 Published 2026-04-02 Fixed in 6.1.0 CWE-639

TI-2026-17337 CVE-2026-21483 · GHSA-jmr4-p576-v565

MEDIUM 64

listmonk is a standalone, self-hosted, newsletter and mailing list manager.

CVSS 4.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00226 Published 2026-01-02 Fixed in 6.0.0, 1.1.1-0.20251231125615-74dc5a01cfbb CWE-79

TI-2025-36190 CVE-2025-58430 · GHSA-rf24-wg77-gq7w

HIGH 72

listmonk is a standalone, self-hosted, newsletter and mailing list manager.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00136 Published 2025-09-09 No fix listed CWE-352

TI-2025-31216 CVE-2025-49136 · GHSA-jc7g-x28f-3v3h

HIGH 74

listmonk is a standalone, self-hosted, newsletter and mailing list manager.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.01648 Published 2025-06-09 Fixed in 5.0.2 CWE-1336

TI-2025-28914 CVE-2025-46011 · GHSA-2jrq-xcm6-56wv

LOW 31

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00304 Published 2025-06-04 No fix listed CWE-89