Dgtlmoon Changedetection.io vulnerabilities

• dgtlmoon changedetection.io dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting CVE-2026-95657 5.1 MediumSeptember 22, 2026
• dgtlmoon changedetection.io dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery CVE-2026-95656 6.9 MediumSeptember 22, 2026
• dgtlmoon changedetection.io dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal CVE-2026-95273 5.3 MediumSeptember 22, 2026
• dgtlmoon changedetection.io dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal CVE-2026-95272 6.3 MediumSeptember 22, 2026
• dgtlmoon changedetection.io dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication CVE-2026-95271 6.9 MediumSeptember 22, 2026
• dgtlmoon changedetection.io dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy CVE-2026-95270 6.3 MediumSeptember 22, 2026
• dgtlmoon changedetection.io changedetection.io through 0.60.6 SSRF via browser-step Goto URL CVE-2026-92815 8.7 HighSeptember 16, 2026
• dgtlmoon changedetection.io changedetection.io through 0.60.6 Cross-Site Scripting via watch_title CVE-2026-92814 2.3 LowSeptember 16, 2026
• dgtlmoon changedetection.io changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force CVE-2026-71205 Public exploit 6.5 MediumAugust 5, 2026
• dgtlmoon changedetection.io changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement CVE-2026-71204 Public exploit 6.3 MediumAugust 5, 2026
• dgtlmoon changedetection.io changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema CVE-2026-71203 Public exploit 5.3 MediumAugust 5, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Arbitrary Local File Read via crafted backup restore CVE-2026-43891 Fix available 7.5 HighMay 5, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: XXE vulnerability in the changedetection.io project CVE-2026-41895 Fix available 8.2 HighMay 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io has an Authentication Bypass via Decorator Ordering CVE-2026-35490 Fix available 9.8 CriticalApril 6, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read CVE-2026-35000 Fix available 7.1 HighApril 1, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters CVE-2026-33981 Fix available 8.3 HighMarch 27, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Zip Slip vulnerability in the backup restore functionality CVE-2026-29065 Fix available 8.8 HighMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: XPath - Arbitrary File Read via unparsed-text() CVE-2026-29039 Fix available 8.8 HighMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Reflected XSS in RSS Tag Error Response CVE-2026-29038 Fix available 6.1 MediumMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVE-2026-27696 Fix available 8.6 HighFebruary 25, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response CVE-2026-27645 Fix available 6.1 MediumFebruary 25, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io vulnerable to unauthenticated static path traversal CVE-2026-25527 Fix available 5.3 MediumFebruary 19, 2026
• changedetection, dgtlmoon changedetection.io +1 more changedetection.io vulnerable to stored XSS in Watch update via API CVE-2025-62780 Fix available 3.5 LowNovember 10, 2025
• dgtlmoon changedetection.io ChangeDetection.io XSS in watch overview CVE-2025-52558 Fix available 7.0 HighJune 23, 2025
• dgtlmoon changedetection.io changedetection.io has Improper Input Validation Leading to LFR/Path Traversal CVE-2024-56509 Fix available 8.6 HighDecember 27, 2024
• dgtlmoon changedetection.io Path traversal using file URI scheme without supplying hostname in changedetection.io CVE-2024-51998 Fix available 8.6 HighNovember 7, 2024
• changedetection, dgtlmoon changedetection.io +1 more changedetection.io Path Traversal vulnerability CVE-2024-51483 Fix available 6.9 MediumNovember 1, 2024
• dgtlmoon changedetection.io Reflected cross site scripting in changedetection.io CVE-2024-34061 Fix available 4.3 MediumMay 2, 2024
• dgtlmoon changedetection.io Server Side Template Injection in Jinja2 allows Remote Command Execution CVE-2024-32651 Public exploitFix available EPSS 85.3% 10.0 CriticalApril 25, 2024
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io API endpoint is not secured with API token CVE-2024-23329 Fix available 3.7 LowJanuary 19, 2024