Mealie vulnerabilities

Products

• Mealie 14

Newest

• mealie A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving... CVE-2025-70297 6.1 MediumFebruary 11, 2026
• mealie A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1... CVE-2025-70296 5.4 MediumFebruary 11, 2026
• mealie Mealie 3.0.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the recipe creation... CVE-2025-56795 Public exploit 9.0 CriticalSeptember 29, 2025
• mealie A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay... CVE-2024-55073 7.6 HighMarch 27, 2025
• mealie A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay... CVE-2024-55072 5.4 MediumMarch 27, 2025
• mealie A Broken Object Level Authorization vulnerability in the component /households/permissions of hay... CVE-2024-55070 3.1 LowMarch 27, 2025
• mealie Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228) CVE-2024-31994 6.5 MediumApril 19, 2024
• mealie Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) CVE-2024-31993 6.2 MediumApril 19, 2024
• mealie Mealie contains a DoS vulnerability in recipe importer CVE-2024-31992 6.5 MediumApril 19, 2024
• mealie Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225) CVE-2024-31991 4.1 MediumApril 19, 2024
• mealie Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to... CVE-2022-34624 5.9 MediumAugust 19, 2022
• mealie Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR)... CVE-2022-34621 6.5 MediumAugust 19, 2022
• mealie Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain... CVE-2022-34615 9.8 CriticalAugust 19, 2022
• mealie The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by... CVE-2022-32425 5.3 MediumJuly 14, 2022