miniflux.app/v2 (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package miniflux.app/v2, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2023-27591 — CVSS 7.5 (high): Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable…
• CVE-2026-21885 — CVSS 6.5 (medium): Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}…
• CVE-2025-67713 — CVSS 6.1 (medium): Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false…
• CVE-2023-27592 — CVSS 4.8 (medium): Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When…
• CVE-2025-31483: Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy…