FreshRSS

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

FreshRSS records in CISA KEV

No FreshRSS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Freshrss 22 records HIGH

Records

23 records

TI-2025-34609 CVE-2025-54875

FreshRSS: Unauthorized creation of admin user when registration is enabled

HIGH 82

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0053 Published 2025-09-29 Fixed in 1.27.0 CWE-284

TI-2025-34363 CVE-2025-54592

FreshRSS has Incomplete Session Termination on Logout

HIGH 79

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0053 Published 2025-09-29 Fixed in 1.27.0 CWE-613

TI-2025-38485 CVE-2025-62166

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

HIGH 72

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-03-09 Fixed in 1.28.0 CWE-284

TI-2025-34362 CVE-2025-54591

FreshRSS: Unauthenticated users can view default user's information

HIGH 72

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00427 Published 2025-09-29 Fixed in 1.27.0 CWE-284

TI-2025-38032 CVE-2025-61586

FreshRSS is vulnerable to directory enumeration by setting path in its theme field

HIGH 70

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00455 Published 2025-09-29 Fixed in 1.27.0 CWE-22

TI-2025-37337 CVE-2025-59949

FreshRSS has Logout CSRF that Leads to DoS via <track src>

HIGH 68

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00445 Published 2025-12-18 Fixed in 1.27.1 CWE-352

TI-2025-35981 CVE-2025-58173

FreshRSS vulnerable to authenticated RCE via path traversal inside include()

HIGH 68

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00701 Published 2025-12-15 Fixed in 1.27.1 CWE-20

TI-2025-34364 CVE-2025-54593

FreshRSS is vulnerable to RCE attacks by authenticated admin

HIGH 67

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00941 Published 2025-08-01 Fixed in 1.26.2 CWE-94

TI-2025-41729 CVE-2025-68148

FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

HIGH 66

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2025-12-26 Fixed in 1.28.0 CWE-770

TI-2025-37338 CVE-2025-59950

FreshRSS: Double clickjacking can lead to privilege escalation

HIGH 65

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00288 Published 2025-09-29 Fixed in 1.27.0 CWE-1021

TI-2025-37336 CVE-2025-59948

FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

HIGH 65

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00334 Published 2025-09-29 Fixed in 1.27.0 CWE-79

TI-2025-22397 CVE-2025-31136

FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry

HIGH 65

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00392 Published 2025-06-04 Fixed in 1.26.2 CWE-79

TI-2025-29082 CVE-2025-46341

Privilege escalation via SSRF when using HTTP auth

MEDIUM 64

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00483 Published 2025-06-04 Fixed in 1.26.2 CWE-918

TI-2025-22395 CVE-2025-31134

FreshRSS vulnerable to directory enumeration via ext.php

MEDIUM 64

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.0047 Published 2025-06-04 Fixed in 1.26.2 CWE-201

TI-2025-23139 CVE-2025-32015

FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>

MEDIUM 63

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00494 Published 2025-06-04 Fixed in 1.26.2 CWE-79

TI-2025-35654 CVE-2025-57769

FressRSS: Clickjacking can lead to XSS and/or privilege escalation

MEDIUM 57

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00276 Published 2025-09-29 Fixed in 1.27.0 CWE-1021

TI-2025-29080 CVE-2025-46339

FreshRSS vulnerable to favicon cache poisoning via proxy

MEDIUM 53

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00182 Published 2025-06-04 Fixed in 1.26.2 CWE-349

TI-2025-22663 CVE-2025-31482

FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

MEDIUM 53

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00184 Published 2025-06-04 Fixed in 1.26.2 CWE-352

TI-2025-42388 CVE-2025-68932

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

MEDIUM 48

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00553 Published 2025-12-26 Fixed in 1.28.0 CWE-338

TI-2022-07556 CVE-2022-23497

Insecure file access in FreshRSS

MEDIUM 41

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0091 Published 2022-12-09 Fixed in 1.20.2 CWE-200

TI-2025-41971 CVE-2025-68402

FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

LOW 35

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00302 Published 2026-03-09 Fixed in 476e57b04646416e24e24c56133c9fadf9e52b95 CWE-287

TI-2018-14005 CVE-2018-19782 · GHSA-378w-3fqw-3555

Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1…

LOW 35

Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.04432 Published 2019-01-29 No fix listed CWE-79

TI-2023-08730 CVE-2023-22481

Sensitive information exposure in the logs of greader API in FreshRSS

LOW 25

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00474 Published 2023-03-06 Fixed in 1.21.0 CWE-532

Open these records in search →