knadh/listmonk Security Advisories | GitStock

high2026-04-01

listmonk's active sessions remain valid after password reset and password change

GHSA-h5j9-cvrw-v5qh · CVE-2026-34828

medium2026-01-02

listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

GHSA-jmr4-p576-v565 · CVE-2026-21483

high2025-09-09

listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover

GHSA-rf24-wg77-gq7w · CVE-2025-58430

critical2025-06-09

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

GHSA-jc7g-x28f-3v3h · CVE-2025-49136