CVE-2026-77066

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

CVE-2026-77066 Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

CVE-2026-77066

The scanFeedsResolver in Omnivore's API passes user-supplied URLs directly to axios.get without validation, unlike the guarded subscribe path. An authenticated user can force internal requests, leaking feed-shaped metadata and probing internal ports. CVSS 3.1 base score is 5.0 (MEDIUM). No in-the...

EUVD-2026-63255

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

CVE-2026-77066: Server-Side Request Forgery (SSRF)

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

PT-2026-78922

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can trigger the server to make requests to arbitrary internal endpoints because the scanFeedsResolver in...