What’s Vulnerable › Products

dgtlmoon changedetection.io vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.

Check whether your dgtlmoon changedetection.io version is affected

Latest dgtlmoon changedetection.io vulnerabilities

• CVE-2026-95657 — dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting (CVSS 3.5)
• CVE-2026-95656 — dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery (CVSS 7.3)
• CVE-2026-95273 — dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal (CVSS 4.3)
• CVE-2026-95272 — dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal (CVSS 3.7)
• CVE-2026-95271 — dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication (CVSS 7.3)
• CVE-2026-95270 — dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy (CVSS 3.7)
• CVE-2026-92815 — changedetection.io through 0.60.6 SSRF via browser-step Goto URL (CVSS 7.5)
• CVE-2026-92814 — changedetection.io through 0.60.6 Cross-Site Scripting via watch_title (CVSS 4.2)
• CVE-2026-71205 — changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force (CVSS 6.5)
• CVE-2026-71204 — changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement (CVSS 6.2)
• CVE-2026-71203 — changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema (CVSS 5.3)
• CVE-2026-43891 — changedetection.io: Arbitrary Local File Read via crafted backup restore (CVSS 7.5)
• CVE-2026-41895 — changedetection.io: XXE vulnerability in the changedetection.io project (CVSS 7.5)
• CVE-2026-35490 — changedetection.io has an Authentication Bypass via Decorator Ordering (CVSS 9.8)
• CVE-2026-35000 — ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read (CVSS 6.5)
• CVE-2026-33981 — Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters (CVSS 6.5)
• CVE-2026-29065 — changedetection.io: Zip Slip vulnerability in the backup restore functionality (CVSS 9.1)
• CVE-2026-29039 — changedetection.io: XPath - Arbitrary File Read via unparsed-text() (CVSS 7.5)
• CVE-2026-29038 — changedetection.io: Reflected XSS in RSS Tag Error Response (CVSS 6.1)
• CVE-2026-27696 — changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs (CVSS 8.6)
• CVE-2026-27645 — changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response (CVSS 6.1)
• CVE-2026-25527 — changedetection.io vulnerable to unauthenticated static path traversal (CVSS 5.3)
• CVE-2025-52558 — ChangeDetection.io XSS in watch overview (CVSS 7.0)
• CVE-2024-56509 — changedetection.io has Improper Input Validation Leading to LFR/Path Traversal (CVSS 8.6)
• CVE-2024-23329 — changedetection.io API endpoint is not secured with API token (CVSS 3.7)