UBUNTU-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

Linux Distros Unpatched Vulnerability : CVE-2026-108735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed'...

DEBIAN-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735

Miniflux versions 2.3.0 through 2.3.3 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This issue allows authenticated users to access internal network addresses by configuring a feed's proxy_url . By pointing this URL at loopback or internal hosts, an attacker can bypass FET...

EUVD-2026-96901

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

Linux Distros Unpatched Vulnerability : CVE-2026-55185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go UR...

DEBIAN-CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

UBUNTU-CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-55185

Miniflux 2 , an open-source feed reader, is vulnerable to an open redirect in versions prior to 2.3.1 . The IsRelativePath function in internal/urllib/url.go validates the redirect_url parameter during the login flow by requiring relative paths and rejecting host/schema entries. However, an unaut...

CVE-2026-55185 Miniflux 2: Open Redirect Bypass

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-55185 Miniflux 2: Open Redirect Bypass

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

EUVD-2026-64137

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...