Is CVE-2026-95656 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95656 being exploited in the wild.

How severe is CVE-2026-95656?

High severity, with a CVSS score of 7.3, published 22 September 2026.

Which products and versions are affected?

Dgtlmoon Changedetection.Io up to 0.60.1.

Is there a fix for CVE-2026-95656?

A patch was published on 2026-07-16: Fixed in version 0.60.1 via commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95656 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-95656?

Check whether you run Dgtlmoon Changedetection.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95656: dgtlmoon changedetection.io server-side request forgery in preview endpoint

CVE-2026-95656 · Severity: high · CVSS 7.3 · Published 2026-09-22

changedetection.io is a web monitoring tool that tracks website changes and alerts users to modifications. A flaw in the preview endpoint allows attackers to manipulate the URL parameter to perform server-side request forgery (SSRF), enabling them to make the server access internal resources or external systems on behalf of the attacker. This could lead to unauthorized data access or facilitate further attacks against internal infrastructure.

Technologies: Dgtlmoon Changedetection.Io. Vendors: Dgtlmoon.

Quick answers

Is CVE-2026-95656 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95656 being exploited in the wild.
How severe is CVE-2026-95656?: High severity, with a CVSS score of 7.3, published 22 September 2026.
Which products and versions are affected?: Dgtlmoon Changedetection.Io up to 0.60.1.
Is there a fix for CVE-2026-95656?: A patch was published on 2026-07-16: Fixed in version 0.60.1 via commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95656 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-95656?: Check whether you run Dgtlmoon Changedetection.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the add_watch_ui_snapshot function within changedetectionio/blueprint/add_watch_ui/__init__.py, where insufficient input validation on the URL parameter allows SSRF. An attacker can send a crafted request remotely to manipulate the server into making requests to arbitrary destinations. The issue has been patched in version 0.60.1 (commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).

Affected products

dgtlmoon changedetection.io up to 0.60.1

Timeline

2026-09-22: disclosed: Vulnerability publicly disclosed
2026-07-16: patched: Fixed in version 0.60.1 via commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.