Rachelos We-Mp-Rss vulnerabilities

2 CVEs affecting Rachelos We-Mp-Rss, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111687, published 2026-10-16.

More from Rachelos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-111687, published 2026-10-16. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint.…
• CVE-2026-110617, published 2026-10-14. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its…