Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Mar 9, 2026FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-68402 · Other software · FreshRSS · reported by GitHubHigh 8.2
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt’s 72-byte input truncation, this causes password verification to succeed even when the user enters an incorrect password. This vulnerability is fixed in 1.27.2-dev (476e57b). The issue was only present in the edge branch and never in a stable release.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-62166 · Other software · FreshRSS · reported by GitHubHigh 7.5
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-68932 · Other software · FreshRSS · reported by GitHubLow 2.9
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for "keep me logged in" functionality. This issue has been patched in version 1.28.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-68148 · Other software · FreshRSS · reported by GitHubMedium 4.3
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-59949 · Other software · FreshRSS · reported by GitHubMedium 5.3
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-58173 · Other software · FreshRSS · reported by GitHubHigh 7.4
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-61586 · Other software · FreshRSS · reported by GitHubMedium 6.9
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-59950 · Other software · FreshRSS · reported by GitHubMedium 6.7
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-59948 · Other software · FreshRSS · reported by GitHubMedium 6.7
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be enabled by the instance administrator beforehand for the attack to work as it relies on api/query.php. An account takeover is possible by sending a change password request via the XSS payload / setting UserJS for persistence / stealing the autofill password / displaying a phishing page with a spoofed URL using history.replaceState() If the victim is an administrator, the attacker can also perform administrative actions. This issue is fixed in version 1.27.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-57769 · Other software · FreshRSS · reported by GitHubMedium 5.3
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-54875 · Other software · FreshRSS · reported by GitHubCritical 9.8
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-54592 · Other software · FreshRSS · reported by GitHubHigh 8.8
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-54591 · Other software · FreshRSS · reported by GitHubHigh 7.5
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025FreshRSS is a free, self-hostable RSS aggregator.CVE-2025-54593 · Other software · FreshRSS · reported by GitHubHigh 7.2
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-46341 · Other software · FreshRSS · reported by GitHubHigh 7.1
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the `Remote-User` header or the `X-WebAuth-User` header by making specially crafted requests via the add feed functionality and obtaining the CSRF token via XPath scraping. The attacker has to know the IP address of the proxied FreshRSS instance and the admin's username, while also having an account on the instance. An attacker can send specially crafted requests in order to gain unauthorized access to internal services. This can also lead to privilege escalation like in the demonstrated scenario, although users that have setup OIDC are not affected by privilege escalation. Version 1.26.2 contains a patch for the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-46339 · Other software · FreshRSS · reported by GitHubMedium 4.3
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-32015 · Other software · FreshRSS · reported by GitHubMedium 6.7
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the `<iframe srcdoc>` attribute, which leads to cross-site scripting (XSS) by loading an attacker's UserJS inside `<script src>`. In order to execute the attack, the attacker needs to control one of the victim's feeds and have an account on the FreshRSS instance that the victim is using. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 contains a patch for the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-31482 · Other software · FreshRSS · reported by GitHubMedium 4.3
FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-31136 · Other software · FreshRSS · reported by GitHubMedium 6.7
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in `f.php` when SVG favicons are downloaded from an attacker-controlled feed containing `<script>` tags inside of them that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sandbox="allow-scripts allow-same-origin"` set as its attribute). An attacker needs to control one of the feeds that the victim is subscribed to, and also must have an account on the FreshRSS instance. Other than that, the iframe payload can be embedded as one of two options. The first payload requires user interaction (the user clicking on the malicious feed entry) with default user configuration, and the second payload fires instantly right after the user adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading functionality, which the second payload bypasses. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible t
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025FreshRSS is a self-hosted RSS feed aggregator.CVE-2025-31134 · Other software · FreshRSS · reported by GitHubMedium 5.5
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023FreshRSS is a self-hosted RSS feed aggregator.CVE-2023-22481 · Other software · FreshRSS · reported by GitHubMedium 4
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where the authentication fails. The issues occurs in `authorizationToUser()` in `greader.php`. If there is an issue with the request or the credentials, `unauthorized()` or `badRequest()` is called. Both these functions are printing the return of `debugInfo()` in the logs. `debugInfo()` will return the content of the request. By default, this will be saved in `users/_/log_api.txt` and if the const `COPY_LOG_TO_SYSLOG` is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022FreshRSS is a free, self-hostable RSS aggregator.CVE-2022-23497 · Other software · FreshRSS · reported by GitHubMedium 6.5
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.
- Product
- FreshRSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2019Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1)CVE-2018-19782 · Other software · Freshrss · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.
- Product
- Freshrss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.