knadh listmonk

• CVE-2026-62361 Medium 5.5 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials 0.3%
• CVE-2026-34828 High 7.1 listmonk: Active sessions remain valid after password reset and password change 0.3%
• CVE-2026-34584 Medium 5.4 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) 0.2%
• CVE-2026-21483 Medium 5.4 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover 0.2%
• CVE-2025-58430 High 8.6 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover 0.1%
• CVE-2025-49136 Critical 9.1 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user 1.6%