we-mp-rss vulnerabilities
CVEs whose affected-version data names the we-mp-rss package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111687Critical· 9.8PoCWeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ex…
▾ Abyssalrachelos · we-mp-rssvia CVEORG
CVE-2026-110617Medium· 4.8PoCwe-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented …
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented …
▾ Twilightrachelos · we-mp-rssvia NVD