VulertSecurity VulertSecurity

Vulnerability Database · PyPI · changedetection-io · Version

changedetection-io 0.48.4

0.48.4 is affected by 28 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.60.9.

Critical 3 High 14 Medium 8 Low 2 Unrated 1

All changedetection-io versions & vulnerabilities → Search the database for this package →
Released 16 Dec 2024 Licence Apache-2.0 Also known from other sources 0 Newer releases 212 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

changedetection-io 0.48.4 vulnerabilities

28 vulnerabilities cover changedetection-io 0.48.4. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-35490: changedetection-io Authentication Bypass Vulnerability 9.8 critical 0.54.8 07 Apr 2026
CVE-2026-35490: changedetection.io Authentication Bypass via Decorator Ordering 9.8 critical 0.54.8 06 Apr 2026
CVE-2026-29065: changedetection.io Arbitrary File Overwrite Vulnerability 9.1 critical 0.54.4 06 Mar 2026
CVE-2026-29065: Zip Slip Vulnerability in changedetection.io Backup Restore Functionality 8.8 high 0.54.4 04 Mar 2026
CVE-2026-29039: changedetection.io Arbitrary File Read via XPath unparsed-text() Vulnerability 8.8 high 0.54.4 04 Mar 2026
CVE-2024-56509: changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal 8.6 high 0.48.05 07 Jul 2026
CVE-2026-27696: changedetection.io Vulnerable to SSRF via Watch URLs 8.6 high 0.54.1 25 Feb 2026
CVE-2026-27696: changedetection.io Server-Side Request Forgery Vulnerability 8.6 high 0.54.1 25 Feb 2026
CVE-2024-56509: changedetection.io Vulnerable to Improper Input Validation Leading to Local File Read and Path Traversal 8.6 high 0.48.05 27 Dec 2024
CVE-2026-33981: Changedetection.io Environment Variable Exposure via jq Filters 8.3 high 0.54.7 27 Mar 2026
CVE-2026-41895: changedetection.io XML External Entity (XXE) Vulnerability 8.2 high No fix published 04 May 2026
CVE-2026-43891: changedetection-io Path Traversal Vulnerability in Backup Restore Functionality 7.5 high 0.55.1 12 May 2026
CVE-2026-41895: changedetection.io XML Parsing Vulnerability Leading to Potential External Entity Attacks 7.5 high 0.54.10 12 May 2026
CVE-2026-43891: changedetection.io Arbitrary Local File Read via Crafted Backup Restore 7.5 high 0.55.1 05 May 2026
CVE-2026-29039: changedetection.io Arbitrary File Read Vulnerability 7.5 high 0.54.4 06 Mar 2026
CVE-2025-52558: changedetection-io XSS Vulnerability in Watch Overview 7.0 high 0.50.4 07 Jul 2026
CVE-2025-52558: ChangeDetection.io XSS Vulnerability in Watch Overview 7.0 high 0.50.4 23 Jun 2025
CVE-2026-33981: changedetection.io Environment Variable Exposure Vulnerability 6.5 medium 0.54.7 27 Mar 2026
CVE-2026-29038: changedetection.io Reflected XSS Vulnerability in /rss/tag/ Endpoint 6.1 medium 0.54.4 06 Mar 2026
CVE-2026-29038: changedetection.io Reflected XSS Vulnerability in RSS Tag Endpoint 6.1 medium 0.54.4 04 Mar 2026
CVE-2026-27645: changedetection.io Reflected XSS Vulnerability in RSS Single Watch Error Response 6.1 medium 0.53.7 25 Feb 2026
CVE-2026-27645: changedetection-io Vulnerability in RSS Endpoint Allows JavaScript Injection 6.1 medium 0.54.1 25 Feb 2026
CVE-2025-62780: changedetection.io Stored XSS Vulnerability in Watch Update API 5.4 medium 0.50.34 10 Nov 2025
CVE-2026-25527: changedetection-io Unauthenticated Static Path Traversal Vulnerability 5.3 medium 0.53.2 20 Jul 2026
CVE-2026-25527: changedetection-io Local File Read Vulnerability 5.3 medium 0.53.2 19 Feb 2026
CVE-2024-23329: Open Source Vulnerability in changedetection-io 3.7 low 402f1e47e78ecd155b1e90f30cce424ff7763e0f 19 Jan 2024
CVE-2025-62780: changedetection.io Stored XSS Vulnerability in Watch Update API 3.5 low 0.50.34 12 Nov 2025
CVE-2026-35000: ChangeDetection.io Protection Bypass Vulnerability N/A unrated 0.54.7 01 Apr 2026

Looking for another version, or everything Vulert holds for changedetection-io?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About changedetection-io 0.48.4

Is changedetection-io 0.48.4 vulnerable?

Yes. 28 vulnerabilities in the Vulert database cover changedetection-io 0.48.4: 3 critical, 14 high, 8 medium and 2 low, plus 1 not yet rated. The upgrade Vulert recommends is 0.60.9, and each entry above names the fixed version to move to.

Which version of changedetection-io should I use instead of 0.48.4?

0.60.9 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.48.4 the latest release of changedetection-io?

No. 0.48.4 was published 16 Dec 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor changedetection-io for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the changedetection-io version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.