Monitoring

In changedetection.io versions prior to 0.54.4 a critical severity vulnerability CVE-2026-29065 was detected. This vulnerability allows attackers to overwrite arbitrary files via path traversal in the backup restore functionality by uploading crafted ZIP archives (Zip Slip). To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29065.

In changedetection.io versions prior to 0.54.4 a medium severity vulnerability CVE-2026-29039 was detected. This vulnerability allows attackers to read arbitrary files on the server by supplying malicious XPath expressions using the unparsed-text() function via the include_filters field. To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29039.

In changedetection.io versions prior to 0.54.4 a medium severity vulnerability CVE-2026-29038 was detected. This vulnerability allows attackers to execute reflected cross-site scripting (XSS) by injecting malicious JavaScript through the tag_uuid parameter in the /rss/tag/ endpoint, which is rendered without HTML escaping. To address this issue, users should upgrade changedetection.io to version 0.54.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29038.

In changedetection.io versions prior to 0.54.1 a medium severity vulnerability CVE-2026-27645 was detected. This vulnerability allows an attacker to perform Reflected Cross-Site Scripting (XSS) via the RSS single-watch endpoint, where the UUID path parameter is reflected in the HTTP response without HTML escaping, leading to execution of arbitrary JavaScript in the user’s browser. To address this issue, users should upgrade changedetection.io to version 0.54.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27645.

In LibreNMS versions 25.12.0 and below a critical severity vulnerability CVE-2026-26988 was detected. This vulnerability allows authenticated attackers to perform SQL Injection via the ajax_table.php endpoint by manipulating the IPv6 address prefix, potentially leading to unauthorized data access or database manipulation. To address this issue, users should upgrade LibreNMS to version 26.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26988.

In LibreNMS versions 25.12.0 and below a medium severity vulnerability CVE-2026-26987 was detected. This vulnerability allows attackers to perform Reflected Cross-Site Scripting (XSS) via the email field. To address this issue, users should upgrade LibreNMS to version 26.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26987.

In changedetection.io versions prior to 0.54.1 a medium severity vulnerability CVE-2026-27696 was detected. This vulnerability allows an authenticated user—or any user when no password is configured—to perform Server-Side Request Forgery (SSRF) via watch URLs, potentially exposing internal network resources and enabling data exfiltration. To address this issue, users should upgrade changedetection.io to version 0.54.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27696.

In LibreNMS versions 24.10.0 through 26.1.1 a medium severity vulnerability CVE-2026-27016 was detected. This vulnerability allows attackers to inject malicious scripts through the Custom OID unit parameter due to missing strip_tags() sanitization. The unsanitized input is stored in the database and rendered without proper HTML escaping, allowing stored cross-site scripting (XSS) attacks when the affected data is viewed. To address this issue, users should upgrade LibreNMS to version 26.2.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27016.

In LibreNMS versions 26.1.1 and below a medium severity vulnerability CVE-2026-26992 was detected. This vulnerability allows attackers with administrative privileges to inject and store malicious scripts through the unsanitized port group name parameter, which may execute when viewed by other users, potentially compromising their session or browser context. To address this issue, users should upgrade LibreNMS to version 26.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26992.