changedetection-io vulnerabilities (PyPI)

20 vulnerabilities.

• changedetection-io PyPI changedetection.io: Arbitrary Local File Read via crafted backup restore CVE-2026-43891 Fix available 7.5 HighMay 5, 2026
• changedetection-io PyPI changedetection.io: XXE vulnerability in the changedetection.io project CVE-2026-41895 Fix available 8.2 HighMay 4, 2026
• changedetection-io PyPI changedetection.io has an Authentication Bypass via Decorator Ordering CVE-2026-35490 Fix available 9.8 CriticalApril 6, 2026
• changedetection-io PyPI ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read CVE-2026-35000 Fix available 7.1 HighApril 1, 2026
• changedetection-io PyPI Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters CVE-2026-33981 Fix available 8.3 HighMarch 27, 2026
• changedetection-io PyPI changedetection.io: Zip Slip vulnerability in the backup restore functionality CVE-2026-29065 Fix available 8.8 HighMarch 4, 2026
• changedetection-io PyPI changedetection.io: XPath - Arbitrary File Read via unparsed-text() CVE-2026-29039 Fix available 8.8 HighMarch 4, 2026
• changedetection-io PyPI changedetection.io: Reflected XSS in RSS Tag Error Response CVE-2026-29038 Fix available 6.1 MediumMarch 4, 2026
• changedetection-io PyPI changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVE-2026-27696 Fix available 8.6 HighFebruary 25, 2026
• changedetection-io PyPI changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response CVE-2026-27645 Fix available 6.1 MediumFebruary 25, 2026
• changedetection-io PyPI changedetection.io vulnerable to unauthenticated static path traversal CVE-2026-25527 Fix available 5.3 MediumFebruary 19, 2026
• changedetection-io PyPI changedetection.io vulnerable to stored XSS in Watch update via API CVE-2025-62780 Fix available 3.5 LowNovember 10, 2025
• changedetection-io PyPI ChangeDetection.io XSS in watch overview CVE-2025-52558 Fix available 7.0 HighJune 23, 2025
• changedetection-io PyPI changedetection.io has Improper Input Validation Leading to LFR/Path Traversal CVE-2024-56509 Fix available 8.6 HighDecember 27, 2024
• changedetection-io PyPI Path traversal using file URI scheme without supplying hostname in changedetection.io CVE-2024-51998 Fix available 8.6 HighNovember 7, 2024
• changedetection-io PyPI changedetection.io Path Traversal vulnerability CVE-2024-51483 Fix available 6.9 MediumNovember 1, 2024
• changedetection-io PyPI Reflected cross site scripting in changedetection.io CVE-2024-34061 Fix available 4.3 MediumMay 2, 2024
• changedetection-io PyPI Server Side Template Injection in Jinja2 allows Remote Command Execution CVE-2024-32651 Public exploitFix available EPSS 83.6% 10.0 CriticalApril 25, 2024
• changedetection-io PyPI changedetection.io API endpoint is not secured with API token CVE-2024-23329 Fix available 3.7 LowJanuary 19, 2024
• changedetection-io PyPI Stored cross site scripting in changedetection.io CVE-2023-24769 Fix available 5.4 MediumFebruary 17, 2023