HIGH7.5Go
GHSA-3qjf-qh38-x73v· CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Modified: 9/10/2026
package
Go/miniflux.app
pkg:go/miniflux.app
—Go
GO-2025-3591· CVE-2025-31483, GHSA-cq88-842x-2jhpMiniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
Modified: 3/3/2026
—Go
GO-2025-4226· CVE-2025-67713, GHSA-wqv2-4wpg-8hc9Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
Modified: 3/3/2026
—Go
GO-2026-4287· CVE-2026-21885, GHSA-xwh2-742g-w3wpMiniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
Modified: 3/3/2026
—Go
GO-2026-5500· CVE-2026-55185, GHSA-m999-j542-5w3rOpen Redirect Bypass in miniflux-v2 in miniflux.app
Modified: 6/25/2026