What’s Vulnerable › Products

miniflux vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your miniflux version is affected

Latest miniflux vulnerabilities

• CVE-2026-108735 — Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL (CVSS 4.3)
• CVE-2026-21885 — Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources (CVSS 6.5)
• CVE-2025-67713 — Miniflux 2 has an Open Redirect via protocol-relative `redirect_url` (CVSS 6.1)
• CVE-2023-27592 — Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler (CVSS 5.4)
• CVE-2023-27591 — Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics (CVSS 7.5)