# cve.now: Dgtlmoon

The newest entries naming Dgtlmoon as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95657](https://cve.now/CVE-2026-95657.md): dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting (CVSS 5.1)
- [CVE-2026-95656](https://cve.now/CVE-2026-95656.md): dgtlmoon changedetection.io Preview Endpoint \_\_init\_\_.py add\_watch\_ui\_snapshot server-side request forgery (CVSS 6.9)
- [CVE-2026-95273](https://cve.now/CVE-2026-95273.md): dgtlmoon changedetection.io visual\_selector\_data flask\_app.py static\_content path traversal (CVSS 5.3)
- [CVE-2026-95272](https://cve.now/CVE-2026-95272.md): dgtlmoon changedetection.io Screenshot flask\_app.py static\_content path traversal (CVSS 6.3)
- [CVE-2026-95271](https://cve.now/CVE-2026-95271.md): dgtlmoon changedetection.io Authentication Hook flask\_app.py check\_authentication improper authentication (CVSS 6.9)
- [CVE-2026-95270](https://cve.now/CVE-2026-95270.md): dgtlmoon changedetection.io Hash Comparison flask\_app.py check\_password timing discrepancy (CVSS 6.3)
- [CVE-2026-92815](https://cve.now/CVE-2026-92815.md): changedetection.io through 0.60.6 SSRF via browser-step Goto URL (CVSS 8.7)
- [CVE-2026-92814](https://cve.now/CVE-2026-92814.md): changedetection.io through 0.60.6 Cross-Site Scripting via watch\_title (CVSS 2.3)
- [CVE-2026-71205](https://cve.now/CVE-2026-71205.md): changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force (CVSS 6.5)
- [CVE-2026-71204](https://cve.now/CVE-2026-71204.md): changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement (CVSS 6.3)
- [CVE-2026-71203](https://cve.now/CVE-2026-71203.md): changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema (CVSS 5.3)
- [CVE-2026-43891](https://cve.now/CVE-2026-43891.md): changedetection.io: Arbitrary Local File Read via crafted backup restore (CVSS 7.5)
- [CVE-2026-41895](https://cve.now/CVE-2026-41895.md): changedetection.io: XXE vulnerability in the changedetection.io project (CVSS 8.2)
- [CVE-2026-35490](https://cve.now/CVE-2026-35490.md): changedetection.io has an Authentication Bypass via Decorator Ordering (CVSS 9.8)
- [CVE-2026-35000](https://cve.now/CVE-2026-35000.md): ChangeDetection.io \< 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read (CVSS 7.1)
- [CVE-2026-33981](https://cve.now/CVE-2026-33981.md): Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters (CVSS 8.3)
- [CVE-2026-29065](https://cve.now/CVE-2026-29065.md): changedetection.io: Zip Slip vulnerability in the backup restore functionality (CVSS 8.8)
- [CVE-2026-29039](https://cve.now/CVE-2026-29039.md): changedetection.io: XPath - Arbitrary File Read via unparsed-text() (CVSS 8.8)
- [CVE-2026-29038](https://cve.now/CVE-2026-29038.md): changedetection.io: Reflected XSS in RSS Tag Error Response (CVSS 6.1)
- [CVE-2026-27696](https://cve.now/CVE-2026-27696.md): changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs (CVSS 8.6)
- [CVE-2026-27645](https://cve.now/CVE-2026-27645.md): changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response (CVSS 6.1)
- [CVE-2026-25527](https://cve.now/CVE-2026-25527.md): changedetection.io vulnerable to unauthenticated static path traversal (CVSS 5.3)
- [CVE-2025-62780](https://cve.now/CVE-2025-62780.md): changedetection.io vulnerable to stored XSS in Watch update via API (CVSS 3.5)
- [CVE-2025-52558](https://cve.now/CVE-2025-52558.md): ChangeDetection.io XSS in watch overview (CVSS 7.0)
- [CVE-2024-56509](https://cve.now/CVE-2024-56509.md): changedetection.io has Improper Input Validation Leading to LFR/Path Traversal (CVSS 8.6)
- [CVE-2024-51998](https://cve.now/CVE-2024-51998.md): Path traversal using file URI scheme without supplying hostname in changedetection.io (CVSS 8.6)
- [CVE-2024-51483](https://cve.now/CVE-2024-51483.md): changedetection.io Path Traversal vulnerability (CVSS 6.9)
- [CVE-2024-34061](https://cve.now/CVE-2024-34061.md): Reflected cross site scripting in changedetection.io (CVSS 4.3)
- [CVE-2024-32651](https://cve.now/CVE-2024-32651.md): Server Side Template Injection in Jinja2 allows Remote Command Execution (CVSS 10.0)
- [CVE-2024-23329](https://cve.now/CVE-2024-23329.md): changedetection.io API endpoint is not secured with API token (CVSS 3.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/dgtlmoon
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.