freshrss vulnerabilities
CVEs whose affected-version data names the freshrss package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2025-68932Critical· 9.8FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces…
CVE-2025-68148Medium· 4.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusabl…
CVE-2025-59949Medium· 5.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
CVE-2025-58173High· 8.8FreshRSS is a self-hosted RSS feed aggregator
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions a…