Skip to contentTandoorrecipes Recipes vulnerabilities
- tandoorrecipes recipesTandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URLCVE-2026-1158106.3 Medium
- tandoorrecipes recipesTandoor Recipes: Blind SSRF via AI provider URL (api_base)CVE-2026-59970Public exploit7.7 High
- tandoorrecipes recipesTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe contentCVE-2026-617268.1 High
- tandoorrecipes recipesTandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex PatternsCVE-2026-599665.7 Medium
- tandoorrecipes recipesTandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpointsCVE-2026-599637.1 High
- tandoorrecipes recipesTandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor RecipesCVE-2026-599626.5 Medium
- tandoorrecipes recipesTandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImportCVE-2026-599675.4 Medium
- tandoor recipesTandoor Recipes Affected by Denial of Service via Recipe ImportCVE-2026-274606.5 Medium
- tandoor recipesTandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`CVE-2026-354897.3 High
- tandoor recipesTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersCVE-2026-354888.1 High
- tandoor recipesTandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)CVE-2026-350465.4 Medium
- tandoor recipesTandoor Recipes Affected by Private Recipe Exposure and Unauthorized ModificationCVE-2026-35045Public exploit8.1 High
- tandoor recipesTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationCVE-2026-331529.1 Critical
- tandoor recipesTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicCVE-2026-331537.7 High
- tandoor recipesURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyCVE-2026-331486.5 Medium
- tandoor recipesTandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PIICVE-2026-290555.3 Medium
- tandoor recipesTandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404CVE-2026-285035.5 Medium
- tandoor recipesTandoor Recipes Vulnerable to Host Header InjectionCVE-2026-33149Public exploit8.1 High
- tandoor recipesTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe ImportCVE-2026-25991Public exploit7.7 High
- tandoor recipesTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadCVE-2026-25964Public exploit4.9 Medium
- tandoor recipesTandoor Recipes - Stored XSS through Unrestricted File UploadCVE-2025-232138.7 High
- tandoor recipesTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverCVE-2025-232127.7 High
- tandoor recipesTandoor Recipes - SSTI - Remote Code ExecutionCVE-2025-23211Public exploit10.0 Critical
- recipesRecipes 1.5.10 - Blind SSRFCVE-2024-04036.5 Medium
- recipesRecipes - Stored XSS in Name ParameterCVE-2022-230743.5 Low
- recipesRecipes - Stored XSS in ClipboardCVE-2022-230733.5 Low
- recipesRecipes - Stored XSS in Add to CartCVE-2022-230723.5 Low
- recipesRecipes - SSRF on ImportCVE-2022-230716.5 Medium