medium · CVSS v3 5.4 · CVSS v4 5.3

CVE-2026-125366

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server …

Description

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
5.4
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-125375

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.

View analysis

medium

CVE-2026-117477

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

View analysis

medium

CVE-2026-125077

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

View analysis

medium

CVE-2026-125357

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

View analysis