Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

changedetection-io

20 known vulnerabilities (2 critical, 10 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
0.70.2 (Nov 5, 2026): no advisory affects it
Newest unaffected release
0.70.2 (Nov 5, 2026), the latest release
Advisories
20 · 2 critical, 10 high, 6 medium, 2 low
Weekly downloads
4,860
Dependents
2
Releases
215 since 0.38.2 (Aug 16, 2021)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 20 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 20

  • changedetection.io: Arbitrary Local File Read via crafted backup restore

    Affected: fixed in 0.55.1.

    Fixed in 0.55.1 (released Apr 27, 2026, 15 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io: XXE vulnerability in the changedetection.io project

    Affected: through 0.54.9; fixed in 0.54.10.

    Fixed in 0.54.10 (released Apr 20, 2026, 22 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2026-35490Critical 9.8

    changedetection.io has an Authentication Bypass via Decorator Ordering

    Affected: fixed in 0.54.8.

    Fixed in 0.54.8 (released Apr 4, 2026, 3 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

    Affected: fixed in 0.54.7.

    Fixed in 0.54.7 (released Mar 26, 2026, 6 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

    Affected: fixed in 0.54.7.

    Fixed in 0.54.7 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io: Zip Slip vulnerability in the backup restore functionality

    Affected: fixed in 0.54.4.

    Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io: XPath - Arbitrary File Read via unparsed-text()

    Affected: fixed in 0.54.4.

    Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2026-29038Medium 6.1

    changedetection.io: Reflected XSS in RSS Tag Error Response

    Affected: fixed in 0.54.4.

    Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs

    Affected: fixed in 0.54.1.

    Fixed in 0.54.1 (released Feb 23, 2026, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2026-27645Medium 6.1

    changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

    Affected: fixed in 0.54.1; fixed in 0.53.7.

    Fixed in 0.54.1 (released Feb 23, 2026, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2026-25527Medium 5.3

    changedetection.io vulnerable to unauthenticated static path traversal

    Affected: fixed in 0.53.2.

    Fixed in 0.53.2 (released Feb 16, 2026, 3 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io vulnerable to stored XSS in Watch update via API

    Affected: fixed in 0.50.34.

    Fixed in 0.50.34 (released Oct 28, 2025, 13 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • ChangeDetection.io XSS in watch overview

    Affected: fixed in 0.50.4.

    Fixed in 0.50.4 (released Jun 21, 2025, 2 days before disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io has Improper Input Validation Leading to LFR/Path Traversal

    Affected: fixed in 0.48.05.

    Fixed in 0.48.5 (released Dec 27, 2024, the day of disclosure).

    The latest release, 0.70.2, is not affected.

  • Path traversal using file URI scheme without supplying hostname in changedetection.io

    Affected: fixed in 0.47.6.

    Fixed in 0.47.6 (released Nov 7, 2024, the day of disclosure).

    The latest release, 0.70.2, is not affected.

Show all 20 advisoriesShow fewer advisories
  • CVE-2024-51483Medium 6.9

    changedetection.io Path Traversal vulnerability

    Affected: fixed in 0.47.5.

    Fixed in 0.47.5 (released Oct 31, 2024, 1 day before disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2024-34061Medium 4.3

    Reflected cross site scripting in changedetection.io

    Affected: fixed in 0.45.22.

    Fixed in 0.45.22 (released May 2, 2024, the day of disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2024-32651Critical 10.0

    Server Side Template Injection in Jinja2 allows Remote Command Execution

    Affected: fixed in 0.45.21.

    Fixed in 0.45.21 (released Apr 25, 2024, the day of disclosure).

    The latest release, 0.70.2, is not affected.

  • changedetection.io API endpoint is not secured with API token

    Affected: from 0.39.14, fixed in 0.45.13.

    Fixed in 0.45.13 (released Jan 19, 2024, the day of disclosure).

    The latest release, 0.70.2, is not affected.

  • CVE-2023-24769Medium 5.4

    Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page.

    Affected: fixed in 0.40.2; fixed in 0.40.1.1.

    Fixed in 0.40.2 (released Feb 3, 2023, 14 days before disclosure).

    The latest release, 0.70.2, is not affected.