FreshRSS

Products

Exploited and recent CVEs

• CVE-2025-68402 High 8.2 FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch] 0.3%
• CVE-2025-62166 High 7.5 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens 0.4%
• CVE-2025-68148 Medium 4.3 FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After 0.5%
• CVE-2025-68932 Low 2.9 FreshRSS has weak cryptographic randomness in remember-me token and nonce generation 0.6%
• CVE-2025-59949 Medium 5.3 FreshRSS has Logout CSRF that Leads to DoS via <track src> 0.4%
• CVE-2025-58173 High 7.4 FreshRSS vulnerable to authenticated RCE via path traversal inside include() 0.7%
• CVE-2025-59950 Medium 6.7 FreshRSS: Double clickjacking can lead to privilege escalation 0.3%
• CVE-2025-61586 Medium 6.9 FreshRSS is vulnerable to directory enumeration by setting path in its theme field 0.5%
• CVE-2025-59948 Medium 6.7 FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page 0.3%
• CVE-2025-57769 Medium 5.3 FressRSS: Clickjacking can lead to XSS and/or privilege escalation 0.3%
• CVE-2025-54875 Critical 9.8 FreshRSS: Unauthorized creation of admin user when registration is enabled 0.5%
• CVE-2025-54592 High 8.8 FreshRSS has Incomplete Session Termination on Logout 0.5%
• CVE-2025-54591 High 7.5 FreshRSS: Unauthenticated users can view default user's information 0.4%
• CVE-2025-54593 High 7.2 FreshRSS is vulnerable to RCE attacks by authenticated admin 0.9%
• CVE-2025-46341 High 7.1 Privilege escalation via SSRF when using HTTP auth 0.5%
• CVE-2025-46339 Medium 4.3 FreshRSS vulnerable to favicon cache poisoning via proxy 0.2%
• CVE-2025-32015 Medium 6.7 FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc> 0.5%
• CVE-2025-31482 Medium 4.3 FreshRSS vulnerable to DoS by malicious feed entry loading logout URL 0.2%
• CVE-2025-31136 Medium 6.7 FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry 0.4%
• CVE-2025-31134 Medium 5.5 FreshRSS vulnerable to directory enumeration via ext.php 0.5%
• CVE-2023-22481 Medium 4.0 Sensitive information exposure in the logs of greader API in FreshRSS 0.5%
• CVE-2022-23497 Medium 6.5 Insecure file access in FreshRSS 0.9%