dgtlmoon ec7d56f85d CVE-2026-29038 - Reflected XSS in RSS Tag Error Response

2026-03-04 10:56:02 +01:00

..

api

API - Processors configuration is now part of the API (#3902)

2026-02-25 11:30:39 +01:00

blueprint

CVE-2026-29038 - Reflected XSS in RSS Tag Error Response

2026-03-04 10:56:02 +01:00

browser_steps

…

conditions

…

content_fetchers

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

diff

…

jinja2_custom

…

model

Updates/migration - Re-run tag update, re-save to cleanup changedetection.json, code refactor (#3898)

2026-02-18 14:05:23 +01:00

notification

…

processors

Unresolvable hostnames should still be added, they are checked for security at fetch time (#3933)

2026-02-27 11:00:44 +01:00

realtime

API - Processors configuration is now part of the API (#3902)

2026-02-25 11:30:39 +01:00

static

UI - Search modal - fixes for running in sub path

2026-02-18 10:27:12 +01:00

store

API - Processors configuration is now part of the API (#3902)

2026-02-25 11:30:39 +01:00

templates

Notification Token {{diff}} can accept arguments like {{diff_added(lines=5, context=2)}} (#3923)

2026-02-24 16:15:05 +01:00

tests

CVE-2026-29039 - XPath - Arbitrary File Read via unparsed-text()

2026-03-04 10:54:52 +01:00

translations

Adding Ukranian translations, rebuilding translations. (#3936)

2026-02-28 21:59:44 +01:00

widgets

…

__init__.py

0.54.3

2026-03-01 00:18:45 +01:00

.gitignore

…

auth_decorator.py

…

custom_queue.py

…

favicon_utils.py

…

flask_app.py

API - Processors configuration is now part of the API (#3902)

2026-02-25 11:30:39 +01:00

forms.py

CVE-2026-29039 - XPath - Arbitrary File Read via unparsed-text()

2026-03-04 10:54:52 +01:00

gc_cleanup.py

…

html_tools.py

CVE-2026-29039 - XPath - Arbitrary File Read via unparsed-text()

2026-03-04 10:54:52 +01:00

is_safe_url.py

…

languages.py

Adding Ukranian translations, rebuilding translations. (#3936)

2026-02-28 21:59:44 +01:00

notification_service.py

Notification Token {{diff}} can accept arguments like {{diff_added(lines=5, context=2)}} (#3923)

2026-02-24 16:15:05 +01:00

pluggy_interface.py

…

PLUGIN_README.md

…

pytest.ini

…

queue_handlers.py

…

queuedWatchMetaData.py

…

rss_tools.py

…

run_basic_tests.sh

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

run_custom_browser_url_tests.sh

…

run_proxy_tests.sh

…

run_socks_proxy_tests.sh

…

strtobool.py

…

test_cli_opts.sh

…

time_handler.py

Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #846 (#3890)

2026-02-17 02:38:16 +01:00

validate_url.py

CVE-2026-27696 Small fix - Restricted hostnames can still be added but are only checked at fetch-time (not when rendering lists etc) (#3938)

2026-03-01 00:17:29 +01:00

worker_pool.py

…

worker.py

Minor code tidy

2026-02-17 02:46:22 +01:00