HIGH7.5Go
GHSA-3qjf-qh38-x73v· CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Modified: 9/10/2026
package
Go/miniflux.app/v2
pkg:go/miniflux.app/v2
MEDIUMGo
GHSA-cq88-842x-2jhp· CVE-2025-31483, GO-2025-3591Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration
Modified: 4/9/2025
MEDIUMGo
GHSA-m999-j542-5w3r· CVE-2026-55185, GO-2026-5500Open Redirect Bypass in miniflux-v2
Modified: 6/25/2026
MEDIUM4.8Go
GHSA-mqqg-xjhj-wfgw· CVE-2023-27592Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Modified: 9/10/2026
MEDIUMGo
GHSA-wqv2-4wpg-8hc9· CVE-2025-67713, GO-2025-4226Miniflux has an Open Redirect via protocol-relative redirect_url
Modified: 2/3/2026
MEDIUM6.5Go
GHSA-xwh2-742g-w3wp· CVE-2026-21885, GO-2026-4287Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
Modified: 2/3/2026
—Go
GO-2025-3591· CVE-2025-31483, GHSA-cq88-842x-2jhpMiniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
Modified: 3/3/2026
—Go
GO-2025-4226· CVE-2025-67713, GHSA-wqv2-4wpg-8hc9Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
Modified: 3/3/2026
—Go
GO-2026-4287· CVE-2026-21885, GHSA-xwh2-742g-w3wpMiniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
Modified: 3/3/2026
—Go
GO-2026-5500· CVE-2026-55185, GHSA-m999-j542-5w3rOpen Redirect Bypass in miniflux-v2 in miniflux.app
Modified: 6/25/2026