Is CVE-2026-41895 actively exploited?

No active exploitation of CVE-2026-41895 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41895 be exploited remotely?

Yes. CVE-2026-41895 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41895?

CVE-2026-41895 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-41895

HIGH

CVE-2026-41895

CWE-611Published: May 12, 2026· Updated: May 13, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.5th

Official Description

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

NVD Source

Technical Analysis

CVE-2026-41895 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.