Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Only the latest stable version is supported.

Reporting a Vulnerability

Preferably, report the vulnerability privately using GitHub (documentation).

If you do not want to use GitHub, send an email to security AT miniflux DOT net with all the steps to reproduce the problem.

Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
GHSA-mqqg-xjhj-wfgw published Mar 17, 2023 by fguillot

Moderate
Unauthenticated user can bypass allowed networks check to obtain Prometheus metrics
GHSA-3qjf-qh38-x73v published Mar 17, 2023 by fguillot

Low

Learn more about advisories related to miniflux/v2 in the GitHub Advisory Database