Miniflux V2 vulnerabilities

• miniflux v2 Miniflux 2: Open Redirect Bypass CVE-2026-55185 Fix available 5.1 MediumJune 19, 2026
• miniflux project miniflux, miniflux v2 +1 more Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources CVE-2026-21885 Fix available 6.5 MediumJanuary 7, 2026
• miniflux project miniflux, miniflux v2 +1 more Miniflux 2 has an Open Redirect via protocol-relative `redirect_url` CVE-2025-67713 Fix available 5.3 MediumDecember 10, 2025
• miniflux v2 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration CVE-2025-31483 Fix available 4.8 MediumApril 3, 2025
• miniflux project miniflux, miniflux v2 +1 more Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics CVE-2023-27591 Fix available 7.5 HighMarch 17, 2023
• miniflux v2, miniflux project miniflux +1 more Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler CVE-2023-27592 Fix available 4.8 MediumMarch 17, 2023