CVE-2026-95656

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.

• CWE-918

• https://github.com/dgtlmoon/changedetection.io/
• https://github.com/dgtlmoon/changedetection.io/commit/71d332d5a0d3da2a0fe89a392413bf4b7d27c84e
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.60.1
• https://github.com/herantong/cve/blob/main/changedetection.io_ssrf-preview-endpoint_CWE-918
• https://vuldb.com/cve/CVE-2026-95656
• https://vuldb.com/submit/896586
• https://vuldb.com/vuln/408412
• https://vuldb.com/vuln/408412/cti

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9563In Eclipse Parsson published Maven Central artifacts before …7.5
• CVE-2026-9564A vulnerability was found in SourceCodester/oretnom23 Hospit…2.4
• CVE-2026-9565A vulnerability was determined in haojing8312 WorkClaw up to…6.3
• CVE-2026-95653Concrete CMS Community Store before 2.7.8 derives digital pr…7.5
• CVE-2026-95654Databasement before 1.7.14 validates invitation tokens only …7.4
• CVE-2026-95655Aureus ERP before 1.5.0 fails to scope message lookups to th…8.1
• CVE-2026-95657A vulnerability was determined in dgtlmoon Changedetection.i…3.5
• CVE-2026-95658MISP's WorkflowsController exposed the moduleStatelessExecut…6.9
• CVE-2026-95659MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
• CVE-2026-9566A vulnerability was identified in teableio teable up to 1.9.…4.3
• CVE-2026-95660A security flaw has been discovered in Moonshot AI Kimi Code…6.3
• CVE-2026-95661MISP contains a reflected cross-site scripting (XSS) vulnera…5.1