cve.bz

knadh listmonk vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 6.3CVE-2026-128334EPSS 0.5%

    listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliver…

  2. 9.1CVE-2026-128333EPSS 0.5%

    listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obt…

  3. 9.1CVE-2026-128332EPSS 0.5%

    Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit cr…

  4. 5.5CVE-2026-62361EPSS 0.3%

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscri…