Priority MEDIUM 56
A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00416 · Published 2026-09-22 · Fixed in 0.60.1 CWE-79
Priority HIGH 70
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00511 · Published 2026-09-22 · Fixed in 0.60.1 CWE-918
Priority MEDIUM 57
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00517 · Published 2026-09-22 · No fix listed CWE-22
Priority MEDIUM 61
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00668 · Published 2026-09-22 · No fix listed CWE-22
Priority HIGH 70
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00654 · Published 2026-09-22 · No fix listed CWE-287
Priority MEDIUM 61
A flaw has been found in dgtlmoon changedetection.io up to 0.60.7.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-09-22 · No fix listed CWE-203
Priority HIGH 77
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00541 · Published 2026-09-16 · No fix listed CWE-918
Priority MEDIUM 45
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00296 · Published 2026-09-16 · No fix listed CWE-79
Priority LOW 34
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is presen…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00266 · Published 2026-08-05 · No fix listed CWE-307
Priority LOW 30
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
CVSS 3.1MEDIUM 6.3· Network · High privileges · No interaction · EPSS 0.0032 · Published 2026-08-05 · No fix listed CWE-284
Priority LOW 30
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py),…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-08-05 · No fix listed CWE-306
Priority HIGH 72
changedetection.io is a free open source web page change detection tool.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00354 · Published 2026-05-12 · Fixed in 0.55.1 CWE-73
Priority LOW 35
changedetection.io is a free open source web page change detection tool.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00266 · Published 2026-05-12 · No fix listed CWE-611
Priority HIGH 82
changedetection.io is a free open source web page change detection tool.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00545 · Published 2026-04-07 · Fixed in 0.54.8 CWE-863
Priority LOW 31
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions…
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00293 · Published 2026-04-01 · Fixed in 0.54.7 CWE-184
Priority HIGH 75
changedetection.io is a free open source web page change detection tool.
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00484 · Published 2026-03-27 · Fixed in 0.54.7 CWE-200
Priority HIGH 79
changedetection.io is a free open source web page change detection tool.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00586 · Published 2026-03-06 · Fixed in 0.54.4 CWE-22
Priority HIGH 73
changedetection.io is a free open source web page change detection tool.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00538 · Published 2026-03-06 · Fixed in 0.54.4 CWE-94
Priority MEDIUM 60
changedetection.io is a free open source web page change detection tool.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00319 · Published 2026-03-06 · Fixed in 0.54.4 CWE-79
Priority HIGH 76
changedetection.io is a free open source web page change detection tool.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00495 · Published 2026-02-25 · Fixed in 0.54.1 CWE-918
Priority MEDIUM 60
changedetection.io is a free open source web page change detection tool.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00495 · Published 2026-02-25 · Fixed in 0.54.1, 0.53.7 CWE-79
Priority LOW 32
changedetection.io is a free open source web page change detection tool.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01025 · Published 2026-02-19 · Fixed in 0.53.2 CWE-22
Priority MEDIUM 58
changedetection.io is a free open source web page change detection tool.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00462 · Published 2025-11-10 · Fixed in 0.50.34 CWE-79
Priority LOW 32
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.
CVSS 4.0HIGH 7.0· Network · No auth · User interaction · EPSS 0.00594 · Published 2025-06-23 · Fixed in 0.50.4 CWE-79
Priority HIGH 76
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00715 · Published 2024-12-27 · Fixed in 0.48.05 CWE-200
Load more
THREATIST.IORead the docs