miniflux vulnerabilities
9 published CVEs name miniflux among the affected products.
- 9Published CVEs9 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-128330
Miniflux before 2.3.5 Insufficient Session Expiration After Password Change
miniflux · miniflux
Low2.3 - CVE-2026-128331
Miniflux before 2.3.5 Password Change Without Current Password via Settings Form
miniflux · miniflux
Medium6.0 - CVE-2026-108735
Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
miniflux · miniflux
Medium5.3 - CVE-2026-55185
Miniflux 2: Open Redirect Bypass
miniflux · v2
Medium5.1 - CVE-2026-21885
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
miniflux · v2
Medium6.5 - CVE-2025-67713
Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
miniflux · v2
Medium5.3 - CVE-2025-31483
Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
miniflux · v2
Medium4.8 - CVE-2023-27591
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
miniflux · v2
High7.5 - CVE-2023-27592
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
miniflux · v2
Medium4.8