Miniflux Project Miniflux — known CVE vulnerabilities

Every CVE whose affected-product data names Miniflux Project Miniflux, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2023-27591 — CVSS 7.5 (high): Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable…
• CVE-2026-21885 — CVSS 6.5 (medium): Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}…
• CVE-2025-67713 — CVSS 6.1 (medium): Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false…
• CVE-2023-27592 — CVSS 4.8 (medium): Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When…