Skip to content
OpenAdvisories

Package · Alpine

miniflux

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2023-27591

    Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

    Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127…

    miniflux v2 miniflux.app/v2 miniflux.app Alpine Go
  • Medium 4.8
    CVE-2023-27592

    Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler

    Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected C…

    miniflux v2 miniflux.app/v2 miniflux Alpine Go