omnivore-app

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

omnivore-app records in CISA KEV

No omnivore-app vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-53820 CVE-2026-77067 · GHSA-w562-g8x6-3cj6

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

MEDIUM 57

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-08-20 Fixed CWE-918

TI-2026-53819 CVE-2026-77066 · GHSA-w9wc-vx4j-8xwg

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

MEDIUM 57

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-08-20 Fixed CWE-918

TI-2026-56851 CVE-2026-82454 · GHSA-8fpq-5wcx-76h3

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

MEDIUM 46

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00386 Published 2026-08-29 Fixed CWE-347

Open these records in search →

Critical	1
High	0
Medium	2
Low	0
No CVSS	0