CVE Feed

    Dashboard / CVE / CVE-2026-95656

    CVE-2026-95656

    A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.

    Published:Sep 22, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 22, 2026
    EPSS Score:
    CVSS Score:7.3

    Affected Products

    Vendor
    Dgtlmoon
    Product
    Changedetection.io

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-95657 (CVSS 2) — A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function se…
    CVE-2026-95273 (CVSS 2.1) — A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_c…
    CVE-2026-95272 (CVSS 2.9) — A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_conten…
    CVE-2026-95271 (CVSS 5.5) — A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the functi…
    CVE-2026-95270 (CVSS 2.9) — A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_…
    CVE-2026-92815 (CVSS 8.7) — changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthentic…
    CVE-2026-92814 (CVSS 2.3) — changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbit…
    CVE-2026-71205 (CVSS 6.5) — changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with …
    CVE-2026-71204 (CVSS 6.2) — changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merg…
    CVE-2026-71203 (CVSS 5.3) — changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller'…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High