CVE-2026-29038

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.

• CWE-79

• https://github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780Patch
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4Product, Release Notes
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64Exploit, Mitigation, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29031Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29032Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29033Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29034Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29035CivetWeb (commit 4a4f0c95) contains a heap and stack buffer …6.5
• CVE-2026-29036cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-r…7.5
• CVE-2026-29039changedetection.io is a free open source web page change det…7.5
• CVE-2026-2904A vulnerability was determined in UTT HiPER 810G 1.7.7-17111…8.8
• CVE-2026-29041Chamilo is a learning management system. Prior to version 1.…8.8
• CVE-2026-29042Nuclio is a "Serverless" framework for Real-Time Events and …9.8
• CVE-2026-29043HDF5 is software for managing data. In 1.14.1-2 and earlier,…5.5
• CVE-2026-29044EVerest is an EV charging software stack. Prior to version 2…6.5