stringer-rss vulnerabilities

Products

• stringer 1

Latest stringer-rss CVEs

Newest publication first

1. CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

   Published 2026-09-28

   High·CVSS 7.6

   Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.