miniflux vulnerabilities
CVEs whose affected-version data names the miniflux package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108735Medium· 4.3PoCMiniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, byp…
▾ Twilightminiflux · minifluxEPSS 0.27%via NVD
CVE-2025-67713Medium· 6.1Miniflux 2 is an open source feed reader
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme a…
▾ Sunlitminiflux_project · minifluxEPSS 0.22%via NVD