CVE-2026-95657

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.60.1 is capable of addressing this issue. This patch is called aac6fcfa594f17511b8ff73e5eaa4f6c33899de0. It is suggested to upgrade the affected component.

• CWE-79
• CWE-94

• https://github.com/dgtlmoon/changedetection.io/
• https://github.com/dgtlmoon/changedetection.io/commit/aac6fcfa594f17511b8ff73e5eaa4f6c33899de0
• https://github.com/dgtlmoon/changedetection.io/pull/4282
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.60.1
• https://github.com/herantong/cve/blob/main/changedetection.io_xss-visual-selector_CWE-79
• https://vuldb.com/cve/CVE-2026-95657
• https://vuldb.com/submit/896587
• https://vuldb.com/vuln/408413
• https://vuldb.com/vuln/408413/cti

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9564A vulnerability was found in SourceCodester/oretnom23 Hospit…2.4
• CVE-2026-9565A vulnerability was determined in haojing8312 WorkClaw up to…6.3
• CVE-2026-95653Concrete CMS Community Store before 2.7.8 derives digital pr…7.5
• CVE-2026-95654Databasement before 1.7.14 validates invitation tokens only …7.4
• CVE-2026-95655Aureus ERP before 1.5.0 fails to scope message lookups to th…8.1
• CVE-2026-95656A vulnerability was found in dgtlmoon changedetection.io up …7.3
• CVE-2026-95658MISP's WorkflowsController exposed the moduleStatelessExecut…6.9
• CVE-2026-95659MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
• CVE-2026-9566A vulnerability was identified in teableio teable up to 1.9.…4.3
• CVE-2026-95660A security flaw has been discovered in Moonshot AI Kimi Code…6.3
• CVE-2026-95661MISP contains a reflected cross-site scripting (XSS) vulnera…5.1
• CVE-2026-95665MISP contains a reflected cross-site scripting (XSS) vulnera…5.1