Skip to content
OpenAdvisories

Package · Go

github.com/knadh/listmonk

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-34828 Public exploit

    listmonk: Active sessions remain valid after password reset and password change

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes…

    knadh listmonk github.com/knadh/listmonk Go
  • High 8.6
    CVE-2025-58430

    listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, re…

    knadh listmonk github.com/knadh/listmonk Go