Webtechnologies Changedetection vulnerabilities

• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Arbitrary Local File Read via crafted backup restore CVE-2026-43891 Fix available 7.5 HighMay 5, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: XXE vulnerability in the changedetection.io project CVE-2026-41895 Fix available 8.2 HighMay 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io has an Authentication Bypass via Decorator Ordering CVE-2026-35490 Fix available 9.8 CriticalApril 6, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read CVE-2026-35000 Fix available 7.1 HighApril 1, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters CVE-2026-33981 Fix available 8.3 HighMarch 27, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Zip Slip vulnerability in the backup restore functionality CVE-2026-29065 Fix available 8.8 HighMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: XPath - Arbitrary File Read via unparsed-text() CVE-2026-29039 Fix available 8.8 HighMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io: Reflected XSS in RSS Tag Error Response CVE-2026-29038 Fix available 6.1 MediumMarch 4, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVE-2026-27696 Fix available 8.6 HighFebruary 25, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response CVE-2026-27645 Fix available 6.1 MediumFebruary 25, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io vulnerable to unauthenticated static path traversal CVE-2026-25527 Fix available 5.3 MediumFebruary 19, 2026
• dgtlmoon changedetection.io, webtechnologies changedetection +1 more changedetection.io API endpoint is not secured with API token CVE-2024-23329 Fix available 3.7 LowJanuary 19, 2024
• webtechnologies changedetection Stored cross site scripting in changedetection.io CVE-2023-24769 Fix available 5.4 MediumFebruary 17, 2023