11
CVEs
0
Critical
1
High
0
KEV
8
PoC
1
Unpatched C/H
18.2%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
5
LOW
5
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-92815 | Unauthenticated attackers can coerce changedetection.io through 0.60.6 into fetching arbitrary internal network addresses by abusing the 'Goto URL' action inside a browser step, because the application's SSRF guard is applied only to the main watch URL and never to the browser-step optional_value parameter. Successful exploitation returns the raw response from otherwise unreachable internal services, giving high-confidentiality read access with no write or code-execution impact (independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, high confidentiality only, scope unchanged, versus the vendor-scale 8.7 CVSS 4.0 score). Publicly available exploit code exists, and exploitation additionally requires that browser steps be reachable and backed by a configured Playwright/Chrome fetcher; the unauthenticated path applies to default deployments that ship with no access password, while password-protected instances require valid credentials first. | HIGH | 8.7 | 0.4% | 64 |
PoC
No patch
|
| CVE-2026-95271 | changedetection.io through 0.60.7 contains a timing side-channel in the check_authentication function of its Flask authentication hook, allowing unauthenticated remote attackers to potentially recover the application password by analyzing response-time differences. Exploitation is practically limited: it requires sending many requests and performing statistical analysis, and success is degraded by network latency, making it a low-to-moderate priority; a public proof-of-concept exploit exists, and the vendor did not respond to the disclosure. | MEDIUM | 5.5 | 0.7% | 48 |
PoC
No patch
|
| CVE-2026-95656 | Server-side request forgery in changedetection.io's Add Watch preview endpoint (/add_watch_ui/snapshot) allows remote attackers to force the server's browser fetcher to request attacker-chosen http(s) URLs, including loopback services, RFC1918 hosts, and the 169.254.169.254 cloud metadata address, because the url argument is validated only for an http:// or https:// prefix. The route is wrapped in login_optionally_required, so it can be reached unauthenticated on default installs that have no password set and requires credentials only where an operator has configured one; publicly available exploit code exists, and it is not confirmed as actively exploited (no CISA KEV entry). This is a moderate, credible risk rather than a critical one, with impact bounded to what the returned screenshot and rendered page data expose about internal targets; the vendor-released fix is version 0.60.1 (commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e). | MEDIUM | 5.5 | 0.5% | 48 |
PoC
|
| CVE-2026-95270 | A timing side-channel in the password comparison routine (check_password in changedetectionio/flask_app.py) of dgtlmoon changedetection.io through version 0.60.7 allows remote, unauthenticated attackers to infer the shared application password character-by-character by measuring response-time differences. Exploitation is rated difficult (CVSS AC:H) and publicly available exploit code exists, though the practical signal is heavily degraded by network jitter, TLS/reverse-proxy overhead, and interpreter noise; only confidentiality of the single shared login secret is at risk, with no integrity or availability impact. No vendor patch has been identified at time of analysis, and the vendor did not respond to the disclosure. | LOW | 2.9 | 0.4% | 34 |
PoC
No patch
|
| CVE-2026-95272 | Path traversal in changedetection.io 0.60.7 and earlier allows remote attackers to read limited files outside the intended screenshot directory by manipulating the filename argument in the Screenshot Handler's static_content route in changedetectionio/flask_app.py, with no authentication or user interaction required per the vector (PR:N/UI:N). Exploitation is meaningfully constrained by high attack complexity (AC:H) and a 'difficult' exploitability rating, and the impact is confidentiality-only and low (VC:L), so this is a moderate-priority issue rather than a critical one. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the vendor was contacted early about the disclosure but did not respond. | LOW | 2.9 | 0.7% | 34 |
PoC
No patch
|
| CVE-2026-71205 | Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to systematically guess the single shared application password with no throttling, lockout, or attempt counter to impede automated attacks. Because the entire application is protected by one shared credential with no per-user account model, a successful guess grants full administrative control - including the ability to view and regenerate the API token and access all monitored URL configurations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially automatable given the network-accessible endpoint, low complexity (CVSS AC:L), and complete absence of brute-force controls confirmed by requirements.txt inspection. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-92814 | HTML markup injection in changedetection.io through 0.60.6 allows an attacker who controls the <title> of a page being monitored to inject arbitrary markup into the notification messages that changedetection.io generates. When a user's notification template uses the watch_title token and HTML-format notifications are enabled for a channel such as email or Telegram, that markup is delivered as live content rather than escaped text, enabling content spoofing and phishing inside notifications. Exploitation is unauthenticated (PR:N per the assessed vector) but heavily gated by preconditions - the victim must monitor an attacker-influenced page, use the watch_title token, enable HTML notifications, and actually view the rendered notification - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). | LOW | 2.3 | 0.2% | 32 |
PoC
No patch
|
| CVE-2026-71204 | Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privileged user or script submits a minimal POST request that omits the api_access_token_enabled checkbox. Because WTForms encodes an unchecked checkbox as False and the settings handler blindly merges all form fields via .update(), the API access token requirement is cleared without any warning, exposing the full watch list, history, and application configuration to unauthenticated REST API callers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the post-exploitation surface - complete unauthenticated API access - is severe. | MEDIUM | 6.2 | 0.2% | 31 |
No patch
|
| CVE-2026-95273 | Path traversal in changedetection.io 0.60.7 and earlier lets an authenticated low-privilege user read files outside the intended content directory by manipulating the filename argument handled by the static_content function in changedetectionio/flask_app.py (visual_selector_data component). Publicly available exploit code exists and the disclosure is documented by VulDB, but the maintainer did not respond, so no vendor-released patch has been confirmed; exploitation requires a valid low-privilege session (PR:L) and no user interaction. Impact is confidentiality-only - arbitrary file read with no file write, code execution, or availability effect - which keeps the CVSS 5.3 rating moderate and the value of the flaw dependent on which files the traversal can reach. | LOW | 2.1 | 0.5% | 30 |
PoC
No patch
|
| CVE-2026-95657 | Stored cross-site scripting in changedetection.io up to and including 0.55.8 lets a malicious or compromised monitored web page inject markup that is rendered in the Visual Selector UI, because the selector string is written into the DOM with innerHTML rather than as text. Exploitation requires an authenticated user who has added a page they do not control, plus that user opening the Visual Selector for the affected watch, so impact is confined to the victim's own browser session and is limited to integrity of the displayed page. Publicly available exploit code exists, but the issue is not confirmed actively exploited (CISA KEV) and independent assessment rates it low priority given the authentication and user-interaction prerequisites; upgrading to 0.60.1 resolves it. | LOW | 2.0 | 0.4% | 30 |
PoC
|
| CVE-2026-71203 | Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec endpoint in changedetectionio/api/Spec.py lacks the @auth.check_token decorator that protects every other /api/v1/* route. Any network-reachable attacker can issue a plain GET request to this path and receive the complete merged schema - all endpoint paths, accepted parameters, and registered processor plugins - even when API key enforcement is active across all sibling routes. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though the attack requires zero prerequisites beyond network access, making opportunistic reconnaissance trivially achievable. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|