Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: rachelos Clear all filters
TI-2026-75473 CVE-2026-111687 · GHSA-hp95-p2ww-6rvc

Eval injection in WeRSS RSS endpoint allows remote code execution

Priority HIGH 81

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01003 Published 2026-10-16 No fix listed CWE-95
TI-2026-74111 CVE-2026-110617 · GHSA-h2vr-gxjh-m386

we-mp-rss Missing Authorization via Export File Download Endpoint

Priority MEDIUM 61

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication depende…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00644 Published 2026-10-14 No fix listed CWE-862
TI-2026-01863 CVE-2026-2215 · GHSA-4rf7-rfqf-gw8j

rachelos WeRSS we-mp-rss JWT auth.py default key

Priority MEDIUM 61

A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00319 Published 2026-02-09 No fix listed CWE-1394