https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-62166.htmlhttps://patchthecve.com/cve/CVE-2025-62166.htmlWed, 17 Jun 2026 09:51:29 +0000HIGH 7.5: FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulhttps://patchthecve.com/cve/CVE-2025-68932.htmlhttps://patchthecve.com/cve/CVE-2025-68932.htmlTue, 13 Oct 2026 09:10:00 +0000CRITICAL 9.8: FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leadinhttps://patchthecve.com/cve/CVE-2025-68148.htmlhttps://patchthecve.com/cve/CVE-2025-68148.htmlTue, 13 Oct 2026 09:10:00 +0000MEDIUM 4.3: FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in versionhttps://patchthecve.com/cve/CVE-2025-59949.htmlhttps://patchthecve.com/cve/CVE-2025-59949.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 5.3: FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.https://patchthecve.com/cve/CVE-2025-58173.htmlhttps://patchthecve.com/cve/CVE-2025-58173.htmlWed, 14 Oct 2026 13:10:00 +0000HIGH 8.8: FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as thehttps://patchthecve.com/cve/CVE-2025-61586.htmlhttps://patchthecve.com/cve/CVE-2025-61586.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 5.3: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.https://patchthecve.com/cve/CVE-2025-59950.htmlhttps://patchthecve.com/cve/CVE-2025-59950.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.7: FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button insihttps://patchthecve.com/cve/CVE-2025-59948.htmlhttps://patchthecve.com/cve/CVE-2025-59948.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.7: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be https://patchthecve.com/cve/CVE-2025-57769.htmlhttps://patchthecve.com/cve/CVE-2025-57769.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.1: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, https://patchthecve.com/cve/CVE-2025-54875.htmlhttps://patchthecve.com/cve/CVE-2025-54875.htmlMon, 19 Oct 2026 16:10:00 +0000CRITICAL 9.8: FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version https://patchthecve.com/cve/CVE-2025-54592.htmlhttps://patchthecve.com/cve/CVE-2025-54592.htmlMon, 19 Oct 2026 16:10:00 +0000CRITICAL 9.8: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failuhttps://patchthecve.com/cve/CVE-2025-54591.htmlhttps://patchthecve.com/cve/CVE-2025-54591.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.5: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a dehttps://patchthecve.com/cve/CVE-2025-54593.htmlhttps://patchthecve.com/cve/CVE-2025-54593.htmlWed, 17 Jun 2026 09:40:21 +0000HIGH 7.2: FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, u