Vulnerabilities

TI-2026-31955 CVE-2026-43891 · GHSA-8757-69j2-hx56

changedetection.io: Arbitrary Local File Read via crafted backup restore

HIGH 72

changedetection.io is a free open source web page change detection tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00354 Published 2026-05-12 Fixed in 0.55.1 CWE-73

TI-2026-30297 CVE-2026-41895 · GHSA-v7cp-2cx9-x793

changedetection.io: XXE vulnerability in the changedetection.io project

LOW 35

changedetection.io is a free open source web page change detection tool.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00266 Published 2026-05-12 No fix listed CWE-611

TI-2026-27619 CVE-2026-35490 · GHSA-jmrh-xmgh-x9j4

changedetection.io has an Authentication Bypass via Decorator Ordering

HIGH 82

changedetection.io is a free open source web page change detection tool.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00545 Published 2026-04-07 Fixed in 0.54.8 CWE-863

TI-2026-27216 CVE-2026-35000 · GHSA-x3f8-2w95-hw4m

ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

LOW 31

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00293 Published 2026-04-01 Fixed in 0.54.7 CWE-184

TI-2026-26322 CVE-2026-33981 · GHSA-58r7-4wr5-hfx8

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

HIGH 75

changedetection.io is a free open source web page change detection tool.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00484 Published 2026-03-27 Fixed in 0.54.7 CWE-200

TI-2026-23210 CVE-2026-29065 · GHSA-25g8-2mcf-fcx9

changedetection.io: Zip Slip vulnerability in the backup restore functionality

HIGH 79

changedetection.io is a free open source web page change detection tool.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00586 Published 2026-03-06 Fixed in 0.54.4 CWE-22

TI-2026-23185 CVE-2026-29039 · GHSA-6fmw-82m7-jq6p

changedetection.io: XPath - Arbitrary File Read via unparsed-text()

HIGH 73

changedetection.io is a free open source web page change detection tool.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00538 Published 2026-03-06 Fixed in 0.54.4 CWE-94

TI-2026-23184 CVE-2026-29038 · GHSA-8whx-v8qq-pq64

changedetection.io: Reflected XSS in RSS Tag Error Response

MEDIUM 60

changedetection.io is a free open source web page change detection tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00319 Published 2026-03-06 Fixed in 0.54.4 CWE-79

TI-2026-22073 CVE-2026-27696 · GHSA-3c45-4pj5-ch7m

changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs

HIGH 76

changedetection.io is a free open source web page change detection tool.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00495 Published 2026-02-25 Fixed in 0.54.1 CWE-918

TI-2026-22027 CVE-2026-27645 · GHSA-mw8m-398g-h89w

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

MEDIUM 60

changedetection.io is a free open source web page change detection tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00495 Published 2026-02-25 Fixed in 0.54.1, 0.53.7 CWE-79

TI-2026-20636 CVE-2026-25527 · GHSA-9jj8-v89v-xjvw

changedetection.io vulnerable to unauthenticated static path traversal

LOW 32

changedetection.io is a free open source web page change detection tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01025 Published 2026-02-19 Fixed in 0.53.2 CWE-22

TI-2024-15431 CVE-2024-23329 · GHSA-hcvp-2cc7-jrwr

changedetection.io API endpoint is not secured with API token

MEDIUM 51

changedetection.io is an open source tool designed to monitor websites for content changes.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00587 Published 2024-01-19 Fixed in 0.45.13 CWE-863

TI-2023-10287 CVE-2023-24769 · GHSA-68wj-c2jw-5pp9

Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site…

MEDIUM 58

Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00631 Published 2023-02-17 Fixed in 0.40.2 CWE-79