changedetection-io has 16 CVEs on record between 2024 and 2026. The busiest recent month was March 2026 with 4. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Weakness classes
Products
- changedetection-io 16
Worst active — by depth score
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution84CVE-2024-51483Medium· 6.5changedetection.io Path Traversal48CVE-2026-27696High· 8.6changedetection.io is Vulnerable to SSRF via Watch URLs47CVE-2024-56509High· 8.6changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal47CVE-2024-51998High· 8.6changedetection.io path traversal using file URI scheme without supplying hostname47
changedetection-io vulnerabilities
CVEs affecting changedetection-io, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-43891High· 7.5changedetection.io has an Arbitrary Local File Read via a crafted backup restore
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
CVE-2026-35000NoneChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows …
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc(…
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
CVE-2026-29065Highchangedetection.io has Zip Slip vulnerability in the backup restore functionality
changedetection.io has Zip Slip vulnerability in the backup restore functionality
CVE-2026-27645Medium· 6.1PoCchangedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-27696High· 8.6changedetection.io is Vulnerable to SSRF via Watch URLs
changedetection.io is Vulnerable to SSRF via Watch URLs
CVE-2026-25527Medium· 5.3PoCchangedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` ro…
changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This…
CVE-2025-52558HighChangeDetection.io XSS in watch overview
ChangeDetection.io XSS in watch overview
CVE-2024-56509High· 8.6changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
CVE-2024-51998High· 8.6changedetection.io path traversal using file URI scheme without supplying hostname
changedetection.io path traversal using file URI scheme without supplying hostname
CVE-2024-51483Medium· 6.5PoCchangedetection.io Path Traversal
changedetection.io Path Traversal
CVE-2024-32651Critical· 10.0PoCchangedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2024-34061Medium· 4.3PoCchangedetection.io Cross-site Scripting vulnerability
changedetection.io Cross-site Scripting vulnerability
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
changedetection.io API endpoint is not secured with API token