HIGH7.1Go
GHSA-h5j9-cvrw-v5qh· CVE-2026-34828, GO-2026-5414listmonk's active sessions remain valid after password reset and password change
Modified: 6/25/2026
package
Go/github.com/knadh/listmonk
pkg:go/github.com/knadh/listmonk
CRITICAL9.0Go
GHSA-jc7g-x28f-3v3h· CVE-2025-49136, GO-2025-3745listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
Modified: 9/10/2026
MEDIUMGo
GHSA-jmr4-p576-v565· CVE-2026-21483, GO-2026-4277listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
Modified: 2/3/2026
HIGHGo
GHSA-rf24-wg77-gq7w· CVE-2025-58430, GO-2025-3943listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover
Modified: 9/10/2026
—Go
GO-2025-3745· CVE-2025-49136, GHSA-jc7g-x28f-3v3hlistmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk
Modified: 6/10/2025
—Go
GO-2025-3943· CVE-2025-58430, GHSA-rf24-wg77-gq7wlistmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
Modified: 3/3/2026
—Go
GO-2026-4277· CVE-2026-21483, GHSA-jmr4-p576-v565listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
Modified: 1/12/2026
—Go
GO-2026-5414· CVE-2026-34828, GHSA-h5j9-cvrw-v5qhlistmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
Modified: 6/25/2026