CVE-2026-92814Medium· 4.2▾ TwilightPoC availablechangedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like em…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.2%
Last analysed / modified upstream
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92815High· 7.5changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses
CVE-2026-95657Low· 3.5A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8
CVE-2026-95656High· 7.3A vulnerability was found in dgtlmoon changedetection.io up to 50389b07
CVE-2026-95271High· 7.3A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7
CVE-2026-95272Low· 3.7A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7
CVE-2026-95273Medium· 4.3A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7