CVE-2026-77066

creationtimestamp| type| source ---|---|--- 2026-08-20 12:16:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hxf4xjk6ezdir...

CVE-2026-77066

The scanFeedsResolver in Omnivore's API passes user-supplied URLs directly to axios.get without validation, unlike the guarded subscribe path. An authenticated user can force internal requests, leaking feed-shaped metadata and probing internal ports. CVSS 3.1 base score is 5.0 (MEDIUM). No in-the...