Skip to content
OpenAdvisories

Vendor

omnivore-app

3 known vulnerabilities.

Products

omnivore 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-77067

    Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

    The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.t…

    omnivore-app omnivore
  • Medium 5.0
    CVE-2026-77066

    Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

    The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects priva…

    omnivore-app omnivore