6 matches found
EUVD-2026-120529
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch witho...
CVE-2026-125366
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch witho...
CVE-2026-125366: asciimoo omnom: Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch witho...
CVE-2026-125366
Omnom versions through 0.9.0 are susceptible to a server-side request forgery (SSRF) vulnerability. Authenticated users can submit feed URLs to the /add_feed route, which allows them to trigger requests to arbitrary hosts. Specifically, the application fails to validate internal addresses process...
CVE-2026-125366 Omnom through 0.9.0 SSRF via Add Feed /add_feed Route
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /addfeed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch witho...
PT-2026-141189
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch...