CVE-2025-31482 FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue...

CVE-2025-31136 FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting XSS issue that occurs in f.php when SVG favicons are downloaded from an attacker-controlled feed containing tags...

CVE-2025-31482: Cross-Site Request Forgery (CSRF)

FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue...

CVE-2021-29256

creationtimestamp| type| source ---|---|--- 2021-05-25 03:01:58+00:00| published-proof-of-concept| Telegram/jhwyL11yVmFESpcelIBi7PAHZPodVkOAezDp-1y2seYC-7o 2023-07-07 12:20:04+00:00| exploited| https://t.me/truesecator/4590 2023-07-07 18:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e012...