https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:27:17 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-71204 <p>changedetection.io&#39;s /settings save handler builds an update dict from form.data[&#39;application&#39;] and blind-merges it into the stored application settings via .update.</p> <p>changedetection.io&#39;s /settings save handler builds an update dict from form.data[&#39;application&#39;] and blind-merges it into the stored application settings via .update.</p> https://db.gcve.eu/vuln/fkie_cve-2026-71204 https://db.gcve.eu/vuln/ghsa-84vg-9r54-xpgh <p>changedetection.io&#39;s /settings save handler builds an update dict from form.data[&#39;application&#39;] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than &#39;unchanged&#39;, and only the &#39;password&#39; field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests.</p> <p>changedetection.io&#39;s /settings save handler builds an update dict from form.data[&#39;application&#39;] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than &#39;unchanged&#39;, and only the &#39;password&#39; field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests.</p> https://db.gcve.eu/vuln/ghsa-84vg-9r54-xpgh