miniflux vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20252
3. 20263

Newest CVEs

• CVE-2026-108735

  Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL

  miniflux · miniflux

  Medium5.3
• CVE-2026-55185

  Miniflux 2: Open Redirect Bypass

  miniflux · v2

  Medium5.1
• CVE-2026-21885

  Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

  miniflux · v2

  Medium6.5
• CVE-2025-67713

  Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`

  miniflux · v2

  Medium5.3
• CVE-2025-31483

  Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration

  miniflux · v2

  Medium4.8
• CVE-2023-27591

  Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

  miniflux · v2

  High7.5
• CVE-2023-27592

  Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler

  miniflux · v2

  Medium4.8