https://db.gcve.eu/sightings/feed 2026-05-04T17:07:19.991531+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/3ff52a96-8367-48a3-8e9a-173128d2a923/export 2026-05-04T17:07:20.474229+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "3ff52a96-8367-48a3-8e9a-173128d2a923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-JC7G-X28F-3V3H", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17703", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49136\n\ud83d\udd25 CVSS Score: 9.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.\n\ud83d\udccf Published: 2025-06-09T16:21:48.266Z\n\ud83d\udccf Modified: 2025-06-09T16:21:48.266Z\n\ud83d\udd17 References:\n1. https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h\n2. https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e\n3. https://github.com/knadh/listmonk/releases/tag/v5.0.2", "creation_timestamp": "2025-06-09T16:56:04.000000Z"} 2025-06-09T16:56:04+00:00 https://db.gcve.eu/sighting/32a4643b-6fbb-4890-bc1d-587c2429de64/export 2026-05-04T17:07:20.474174+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "32a4643b-6fbb-4890-bc1d-587c2429de64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-jc7g-x28f-3v3h", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114654489485948868", "content": "", "creation_timestamp": "2025-06-09T17:04:30.684513Z"} 2025-06-09T17:04:30.684513+00:00 https://db.gcve.eu/sighting/32711a3b-9a37-403b-95a7-dd00acddf116/export 2026-05-04T17:07:20.474104+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "32711a3b-9a37-403b-95a7-dd00acddf116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-jc7g-x28f-3v3h", "type": "seen", "source": "https://gist.github.com/alon710/2aeb9181d822da66f0341f802419d7a7", "content": "", "creation_timestamp": "2026-01-24T21:30:38.000000Z"} 2026-01-24T21:30:38+00:00 https://db.gcve.eu/sighting/c18197e5-052c-4f81-ac16-4038250913a5/export 2026-05-04T17:07:20.474006+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "c18197e5-052c-4f81-ac16-4038250913a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-jc7g-x28f-3v3h", "type": "seen", "source": "https://gist.github.com/alon710/128173bdf7a72d5dd0cfdf8f4e2ec93f", "content": "", "creation_timestamp": "2026-01-24T21:30:40.000000Z"} 2026-01-24T21:30:40+00:00 https://db.gcve.eu/sighting/d4e63a01-fc44-43f4-a645-eb75de91f8c5/export 2026-05-04T17:07:20.471729+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "d4e63a01-fc44-43f4-a645-eb75de91f8c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-jc7g-x28f-3v3h", "type": "seen", "source": "https://gist.github.com/alon710/75bd805fd5fae660ad9e3111584de4d0", "content": "", "creation_timestamp": "2026-01-24T22:42:40.000000Z"} 2026-01-24T22:42:40+00:00