# FreshRSS.

Every CVE that names FreshRSS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FreshRSS has an authentication bypass due to truncated bcrypt hash \[edge branch\]](https://agentprime.io/advisories/CVE-2025-68402.md)
  `CVE-2025-68402` · CVE record: FreshRSS FreshRSS · CVSS 8.2 High · Not analysed yet · Published 9 Mar 2026 · Tags: Authentication bypass
- [FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens](https://agentprime.io/advisories/CVE-2025-62166.md)
  `CVE-2025-62166` · CVE record: FreshRSS FreshRSS · CVSS 7.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control
- [FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After](https://agentprime.io/advisories/CVE-2025-68148.md)
  `CVE-2025-68148` · CVE record: FreshRSS FreshRSS · CVSS 4.3 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Denial of service
- [FreshRSS has weak cryptographic randomness in remember-me token and nonce generation](https://agentprime.io/advisories/CVE-2025-68932.md)
  `CVE-2025-68932` · CVE record: FreshRSS FreshRSS · CVSS 2.9 Low · Not analysed yet · Published 26 Dec 2025 · Tags: Weak cryptography or TLS
- [FreshRSS has Logout CSRF that Leads to DoS via \<track src>](https://agentprime.io/advisories/CVE-2025-59949.md)
  `CVE-2025-59949` · CVE record: FreshRSS FreshRSS · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site request forgery (CSRF)
- [FreshRSS vulnerable to authenticated RCE via path traversal inside include()](https://agentprime.io/advisories/CVE-2025-58173.md)
  `CVE-2025-58173` · CVE record: FreshRSS FreshRSS · CVSS 7.4 High · Not analysed yet · Published 15 Dec 2025 · Tags: Path traversal, CWE-20
- [FreshRSS: Double clickjacking can lead to privilege escalation](https://agentprime.io/advisories/CVE-2025-59950.md)
  `CVE-2025-59950` · CVE record: FreshRSS FreshRSS · CVSS 6.7 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-1021
- [FreshRSS is vulnerable to directory enumeration by setting path in its theme field](https://agentprime.io/advisories/CVE-2025-61586.md)
  `CVE-2025-61586` · CVE record: FreshRSS FreshRSS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Path traversal
- [FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page](https://agentprime.io/advisories/CVE-2025-59948.md)
  `CVE-2025-59948` · CVE record: FreshRSS FreshRSS · CVSS 6.7 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS)
- [FressRSS: Clickjacking can lead to XSS and/or privilege escalation](https://agentprime.io/advisories/CVE-2025-57769.md)
  `CVE-2025-57769` · CVE record: FreshRSS FreshRSS · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS), CWE-1021
- [FreshRSS: Unauthorized creation of admin user when registration is enabled](https://agentprime.io/advisories/CVE-2025-54875.md)
  `CVE-2025-54875` · CVE record: FreshRSS FreshRSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Broken access control
- [FreshRSS has Incomplete Session Termination on Logout](https://agentprime.io/advisories/CVE-2025-54592.md)
  `CVE-2025-54592` · CVE record: FreshRSS FreshRSS · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass
- [FreshRSS: Unauthenticated users can view default user's information](https://agentprime.io/advisories/CVE-2025-54591.md)
  `CVE-2025-54591` · CVE record: FreshRSS FreshRSS · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2025 · Tags: Broken access control
- [FreshRSS is vulnerable to RCE attacks by authenticated admin](https://agentprime.io/advisories/CVE-2025-54593.md)
  `CVE-2025-54593` · CVE record: FreshRSS FreshRSS · CVSS 7.2 High · Not analysed yet · Published 1 Aug 2025 · Tags: Code injection
- [Privilege escalation via SSRF when using HTTP auth](https://agentprime.io/advisories/CVE-2025-46341.md)
  `CVE-2025-46341` · CVE record: FreshRSS FreshRSS · CVSS 7.1 High · Not analysed yet · Published 4 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [FreshRSS vulnerable to favicon cache poisoning via proxy](https://agentprime.io/advisories/CVE-2025-46339.md)
  `CVE-2025-46339` · CVE record: FreshRSS FreshRSS · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-349
- [FreshRSS vulnerable to Cross-site Scripting by embedding \<script> tag inside \<iframe srcdoc>](https://agentprime.io/advisories/CVE-2025-32015.md)
  `CVE-2025-32015` · CVE record: FreshRSS FreshRSS · CVSS 6.7 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Cross-site scripting (XSS)
- [FreshRSS vulnerable to DoS by malicious feed entry loading logout URL](https://agentprime.io/advisories/CVE-2025-31482.md)
  `CVE-2025-31482` · CVE record: FreshRSS FreshRSS · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Cross-site request forgery (CSRF)
- [FreshRSS vulnerable to Cross-site Scripting by \<iframe>'ing a vulnerable same-origin page in a feed entry](https://agentprime.io/advisories/CVE-2025-31136.md)
  `CVE-2025-31136` · CVE record: FreshRSS FreshRSS · CVSS 6.7 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Cross-site scripting (XSS)
- [FreshRSS vulnerable to directory enumeration via ext.php](https://agentprime.io/advisories/CVE-2025-31134.md)
  `CVE-2025-31134` · CVE record: FreshRSS FreshRSS · CVSS 5.5 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Information disclosure
- [Sensitive information exposure in the logs of greader API in FreshRSS](https://agentprime.io/advisories/CVE-2023-22481.md)
  `CVE-2023-22481` · CVE record: FreshRSS FreshRSS · CVSS 4.0 Medium · Not analysed yet · Published 6 Mar 2023 · Tags: Information disclosure
- [Insecure file access in FreshRSS](https://agentprime.io/advisories/CVE-2022-23497.md)
  `CVE-2022-23497` · CVE record: FreshRSS FreshRSS · CVSS 6.5 Medium · Not analysed yet · Published 9 Dec 2022 · Tags: Information disclosure

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=freshrss>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/freshrss/>. Everything for agents: <https://agentprime.io/llms.txt>.