freshrss has 3 CVEs on record. The busiest recent month was December 2025 with 3. The median CVSS is 5.3 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
freshrss vulnerabilities
CVEs affecting freshrss, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2025-68932Critical· 9.8FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces…
CVE-2025-68148Medium· 4.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusabl…
CVE-2025-59949Medium· 5.3FreshRSS is a free, self-hostable RSS aggregator
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.