CVE Feed

    Dashboard / CVE / CVE-2026-92814

    CVE-2026-92814

    changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

    Published:Sep 16, 2026
    Last Modified:Sep 18, 2026
    EPS:Sep 16, 2026
    EPSS Score:0.00221
    CVSS Score:4.2

    Affected Products

    Vendor
    Dgtlmoon
    Product
    Changedetection.io

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-95657 (CVSS 2) — A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function se…
    CVE-2026-95656 (CVSS 5.5) — A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the functi…
    CVE-2026-95273 (CVSS 2.1) — A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_c…
    CVE-2026-95272 (CVSS 2.9) — A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_conten…
    CVE-2026-95271 (CVSS 5.5) — A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the functi…
    CVE-2026-95270 (CVSS 2.9) — A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_…
    CVE-2026-92815 (CVSS 8.7) — changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthentic…
    CVE-2026-71205 (CVSS 6.5) — changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with …
    CVE-2026-71204 (CVSS 6.2) — changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merg…
    CVE-2026-71203 (CVSS 5.3) — changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller'…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High