EUVD-2026-53201

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...

Cross-Site Scripting (XSS)

onegov.form is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the usage of unescaped labels in WTForms...