listmonk
v6.2.0High performance, self-hosted, newsletter and mailing list manager with a modern dashboard. Single binary app.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 6 advisories2 critical, 2 high, 2 medium · Scorecard 5.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
24.3k stars · 2.8k forks · 65 open issues · last release 4 months ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 6 most recent advisories published by the maintainers: 2 critical, 2 high, 2 medium. Check the patched version against the one you run.
- mediumCVE-2026-62361Jun 26, 2026SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
- Affected
- <= 6.1.0
- Patched in
- 6.2.0
- highCVE-2026-34828Apr 1, 2026Active sessions remain valid after password reset and password change
- Affected
- > 4.1.0
- Patched in
- 6.1.0
- mediumCVE-2026-34584Mar 31, 2026List permission bypass in multiple hotpaths
- Affected
- >= v4.1.0
- Patched in
- v6.1.0
- highCVE-2026-21483Jan 2, 2026Stored XSS Leading to Admin Account Takeover
- Affected
- ≤ 5.1.0
- Patched in
- 6.0.0
- criticalCVE-2025-58430Sep 9, 2025CSRF to XSS to Admin Takeover
- Affected
- latest
- criticalCVE-2025-49136Jun 8, 2025`env` Sprig template function allows reading environment variables on the host on campaign templates.
- Affected
- 4.0.0 - 5.0.1
- Patched in
- 5.0.2