Vulnerabilities

TI-2025-41971 CVE-2025-68402

FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

LOW 35

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00302 Published 2026-03-09 Fixed in 476e57b04646416e24e24c56133c9fadf9e52b95 CWE-287

TI-2025-38485 CVE-2025-62166

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

HIGH 72

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-03-09 Fixed in 1.28.0 CWE-284

TI-2025-41729 CVE-2025-68148

FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

HIGH 66

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2025-12-26 Fixed in 1.28.0 CWE-770

TI-2025-42388 CVE-2025-68932

FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

MEDIUM 48

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00553 Published 2025-12-26 Fixed in 1.28.0 CWE-338

TI-2025-37337 CVE-2025-59949

FreshRSS has Logout CSRF that Leads to DoS via <track src>

HIGH 68

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00445 Published 2025-12-18 Fixed in 1.27.1 CWE-352

TI-2025-35981 CVE-2025-58173

FreshRSS vulnerable to authenticated RCE via path traversal inside include()

HIGH 68

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00701 Published 2025-12-15 Fixed in 1.27.1 CWE-20

TI-2025-37338 CVE-2025-59950

FreshRSS: Double clickjacking can lead to privilege escalation

HIGH 65

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00288 Published 2025-09-29 Fixed in 1.27.0 CWE-1021

TI-2025-38032 CVE-2025-61586

FreshRSS is vulnerable to directory enumeration by setting path in its theme field

HIGH 70

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00455 Published 2025-09-29 Fixed in 1.27.0 CWE-22

TI-2025-37336 CVE-2025-59948

FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

HIGH 65

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00334 Published 2025-09-29 Fixed in 1.27.0 CWE-79

TI-2025-35654 CVE-2025-57769

FressRSS: Clickjacking can lead to XSS and/or privilege escalation

MEDIUM 57

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00276 Published 2025-09-29 Fixed in 1.27.0 CWE-1021

TI-2025-34609 CVE-2025-54875

FreshRSS: Unauthorized creation of admin user when registration is enabled

HIGH 82

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0053 Published 2025-09-29 Fixed in 1.27.0 CWE-284

TI-2025-34363 CVE-2025-54592

FreshRSS has Incomplete Session Termination on Logout

HIGH 79

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0053 Published 2025-09-29 Fixed in 1.27.0 CWE-613

TI-2025-34362 CVE-2025-54591

FreshRSS: Unauthenticated users can view default user's information

HIGH 72

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00427 Published 2025-09-29 Fixed in 1.27.0 CWE-284

TI-2025-34364 CVE-2025-54593

FreshRSS is vulnerable to RCE attacks by authenticated admin

HIGH 67

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00941 Published 2025-08-01 Fixed in 1.26.2 CWE-94

TI-2025-29082 CVE-2025-46341

Privilege escalation via SSRF when using HTTP auth

MEDIUM 64

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00483 Published 2025-06-04 Fixed in 1.26.2 CWE-918

TI-2025-29080 CVE-2025-46339

FreshRSS vulnerable to favicon cache poisoning via proxy

MEDIUM 53

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00182 Published 2025-06-04 Fixed in 1.26.2 CWE-349

TI-2025-23139 CVE-2025-32015

FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>

MEDIUM 63

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00494 Published 2025-06-04 Fixed in 1.26.2 CWE-79

TI-2025-22663 CVE-2025-31482

FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

MEDIUM 53

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00184 Published 2025-06-04 Fixed in 1.26.2 CWE-352

TI-2025-22397 CVE-2025-31136

FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry

HIGH 65

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00392 Published 2025-06-04 Fixed in 1.26.2 CWE-79

TI-2025-22395 CVE-2025-31134

FreshRSS vulnerable to directory enumeration via ext.php

MEDIUM 64

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.0047 Published 2025-06-04 Fixed in 1.26.2 CWE-201

TI-2023-08730 CVE-2023-22481

Sensitive information exposure in the logs of greader API in FreshRSS

LOW 25

FreshRSS is a self-hosted RSS feed aggregator.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00474 Published 2023-03-06 Fixed in 1.21.0 CWE-532

TI-2022-07556 CVE-2022-23497

Insecure file access in FreshRSS

MEDIUM 41

FreshRSS is a free, self-hostable RSS aggregator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0091 Published 2022-12-09 Fixed in 1.20.2 CWE-200

TI-2018-14005 CVE-2018-19782 · GHSA-378w-3fqw-3555

Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1…

LOW 35

Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.04432 Published 2019-01-29 No fix listed CWE-79

Vulnerabilities

Filters