freshrss has 4 CVEs on record. The busiest recent month was December 2025 with 4. The median CVSS is 7.1 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
freshrss vulnerabilities
CVEs affecting freshrss, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2025-68932Critical· 9.8FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces…
CVE-2025-68148Medium· 4.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusabl…
CVE-2025-59949Medium· 5.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
CVE-2025-58173High· 8.8FreshRSS is a self-hosted RSS feed aggregator
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions a…