CVE Feed

    Dashboard / CVE / CVE-2026-92815

    CVE-2026-92815

    changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.

    Published:Sep 16, 2026
    Last Modified:Sep 17, 2026
    EPS:Sep 16, 2026
    EPSS Score:0.00406
    CVSS Score:7.5

    Affected Products

    Vendor
    Dgtlmoon
    Product
    Changedetection.io

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-95657 (CVSS 2) — A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function se…
    CVE-2026-95656 (CVSS 5.5) — A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the functi…
    CVE-2026-95273 (CVSS 2.1) — A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_c…
    CVE-2026-95272 (CVSS 2.9) — A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_conten…
    CVE-2026-95271 (CVSS 5.5) — A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the functi…
    CVE-2026-95270 (CVSS 2.9) — A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_…
    CVE-2026-92814 (CVSS 2.3) — changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbit…
    CVE-2026-71205 (CVSS 6.5) — changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with …
    CVE-2026-71204 (CVSS 6.2) — changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merg…
    CVE-2026-71203 (CVSS 5.3) — changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller'…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High