FreshRSS vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 202518
4. 20262

Newest CVEs

• CVE-2025-68402

  FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

  FreshRSS · FreshRSS

  High8.2
• CVE-2025-62166

  FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

  FreshRSS · FreshRSS

  High7.5
• CVE-2025-68148

  FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

  FreshRSS · FreshRSS

  Medium4.3
• CVE-2025-68932

  FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

  FreshRSS · FreshRSS

  Low2.9
• CVE-2025-59949

  FreshRSS has Logout CSRF that Leads to DoS via <track src>

  FreshRSS · FreshRSS

  Medium5.3
• CVE-2025-58173

  FreshRSS vulnerable to authenticated RCE via path traversal inside include()

  FreshRSS · FreshRSS

  High7.4
• CVE-2025-59950

  FreshRSS: Double clickjacking can lead to privilege escalation

  FreshRSS · FreshRSS

  Medium6.7
• CVE-2025-61586

  FreshRSS is vulnerable to directory enumeration by setting path in its theme field

  FreshRSS · FreshRSS

  Medium6.9
• CVE-2025-59948

  FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

  FreshRSS · FreshRSS

  Medium6.7
• CVE-2025-57769

  FressRSS: Clickjacking can lead to XSS and/or privilege escalation

  FreshRSS · FreshRSS

  Medium5.3