Skip to contentTandoor Recipes vulnerabilities
- tandoor recipesTandoor Recipes Affected by Denial of Service via Recipe ImportCVE-2026-274606.5 Medium
- tandoor recipesTandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`CVE-2026-354897.3 High
- tandoor recipesTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersCVE-2026-354888.1 High
- tandoor recipesTandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)CVE-2026-350465.4 Medium
- tandoor recipesTandoor Recipes Affected by Private Recipe Exposure and Unauthorized ModificationCVE-2026-35045Public exploit8.1 High
- tandoor recipesTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationCVE-2026-331529.1 Critical
- tandoor recipesTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicCVE-2026-331537.7 High
- tandoor recipesURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyCVE-2026-331486.5 Medium
- tandoor recipesTandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PIICVE-2026-290555.3 Medium
- tandoor recipesTandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404CVE-2026-285035.5 Medium
- tandoor recipesTandoor Recipes Vulnerable to Host Header InjectionCVE-2026-33149Public exploit8.1 High
- tandoor recipesTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe ImportCVE-2026-25991Public exploit7.7 High
- tandoor recipesTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadCVE-2026-25964Public exploit4.9 Medium
- tandoor recipesTandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation....CVE-2025-573966.5 Medium
- tandoor recipesTandoor Recipes - Stored XSS through Unrestricted File UploadCVE-2025-232138.7 High
- tandoor recipesTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverCVE-2025-232127.7 High
- tandoor recipesTandoor Recipes - SSTI - Remote Code ExecutionCVE-2025-23211Public exploit10.0 Critical
- recipesRecipes 1.5.10 - Blind SSRFCVE-2024-04036.5 Medium
- recipesRecipes - Stored XSS in Name ParameterCVE-2022-230743.5 Low
- recipesRecipes - Stored XSS in ClipboardCVE-2022-230733.5 Low
- recipesRecipes - Stored XSS in Add to CartCVE-2022-230723.5 Low
- recipesRecipes - SSRF on ImportCVE-2022-230716.5 Medium