freshrss vulnerabilities and fixes

Recent CVEs affecting freshrss, with upgrade or downgrade steps. 13 tracked.

freshrss has 13 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-03-09. Highest priority: CVE-2025-54592 (score 58/100).

• CVE-2025-61586 MEDIUM 5.3 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-54592 CRITICAL 9.8 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-54875 CRITICAL 9.8 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-54591 HIGH 7.5 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-59948 MEDIUM 6.7 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-59950 MEDIUM 6.7 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-57769 MEDIUM 6.1 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-58173 HIGH 8.8 UPGRADE FreshRSS is a self-hosted RSS feed aggregator
• CVE-2025-59949 MEDIUM 5.3 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-68932 CRITICAL 9.8 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-68148 MEDIUM 4.3 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-62166 HIGH 7.5 UPGRADE FreshRSS is a free, self-hostable RSS aggregator
• CVE-2025-54593 HIGH 7.2 UPGRADE FreshRSS is a free, self-hostable RSS aggregator

FAQ

How do I fix freshrss vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is freshrss being exploited right now?

None of the tracked freshrss CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which freshrss CVE should I patch first?

CVE-2025-54592 currently ranks highest (58/100): FreshRSS is a free, self-hostable RSS aggregator.

RSS feed for freshrss · ← Back to latest CVEs