Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Sep 22, 2026A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8.CVE-2026-95657 · Other software · dgtlmoon · reported by VulDBLow 2
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component.
- Product
- Changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A vulnerability was found in dgtlmoon changedetection.io up to 50389b07.CVE-2026-95656 · Other software · dgtlmoon · reported by VulDBMedium 5.5
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7.CVE-2026-95273 · Other software · dgtlmoon · reported by VulDBLow 2.1
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7.CVE-2026-95272 · Other software · dgtlmoon · reported by VulDBLow 2.9
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7.CVE-2026-95271 · Other software · dgtlmoon · reported by VulDBMedium 5.5
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026A flaw has been found in dgtlmoon changedetection.io up to 0.60.7.CVE-2026-95270 · Other software · dgtlmoon · reported by VulDBLow 2.9
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses.CVE-2026-92815 · Other software · dgtlmoon · reported by VulnCheckHigh 8.7
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection.CVE-2026-92814 · Other software · dgtlmoon · reported by VulnCheckLow 2.3
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attCVE-2026-71205 · Other software · dgtlmoon · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.5
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .upCVE-2026-71204 · Other software · dgtlmoon · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.2
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource regisCVE-2026-71203 · Other software · dgtlmoon · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 5.3
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-43891 · Other software · dgtlmoon · reported by GitHubHigh 7.5
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-41895 · Other software · dgtlmoon · reported by GitHubHigh 8.2
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-35490 · Other software · dgtlmoon · reported by GitHubCritical 9.8
changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitCVE-2026-35000 · Other software · dgtlmoon · reported by VulnCheckHigh 7.1
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.
- Product
- ChangeDetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-33981 · Other software · dgtlmoon · reported by GitHubHigh 8.3
changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-29065 · Other software · dgtlmoon · reported by GitHubHigh 8.8
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-29039 · Other software · dgtlmoon · reported by GitHubHigh 8.8
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-29038 · Other software · dgtlmoon · reported by GitHubMedium 6.1
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-27696 · Other software · dgtlmoon · reported by GitHubHigh 8.6
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-27645 · Other software · dgtlmoon · reported by GitHubMedium 6.1
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026changedetection.io is a free open source web page change detection tool.CVE-2026-25527 · Other software · dgtlmoon · reported by GitHubMedium 5.3
changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025changedetection.io is a free open source web page change detection tool.CVE-2025-62780 · Other software · dgtlmoon · reported by GitHubLow 3.5
changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.CVE-2025-52558 · Other software · dgtlmoon · reported by GitHubHigh 7
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting (XSS) vulnerability. This issue has been patched in version 0.50.4
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.CVE-2024-56509 · Other software · dgtlmoon · reported by GitHubHigh 8.6
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient. This vulnerability is fixed in 0.48.05.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024changedetection.io is a free open source web page change detection tool.CVE-2024-51998 · Other software · dgtlmoon · reported by GitHubHigh 8.6
changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined. The check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes. This issue has been addressed in version 0.47.06 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024changedetection.io is free, open source web page change detection software.CVE-2024-51483 · Other software · dgtlmoon · reported by GitHubMedium 6.9
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.CVE-2024-34061 · Other software · dgtlmoon · reported by GitHubMedium 4.3
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service.CVE-2024-32651 · Other software · dgtlmoon · reported by GitHubCritical 10
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hacktivesecurity.comgithub.com
Jan 19, 2024 changedetection.io is an open source tool designed to monitor websites for content changes.CVE-2024-23329 · Other software · dgtlmoon · reported by GitHubLow 3.7
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- changedetection.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page.CVE-2023-24769 · Other software · Webtechnologies · reported by MITREMedium 5.4
Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the "Add a new change detection watch" function.
- Product
- Changedetection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comedoardoottavianelli.it
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.