What’s Vulnerable › Products

TandoorRecipes recipes vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.

Check whether your TandoorRecipes recipes version is affected

Latest TandoorRecipes recipes vulnerabilities

• CVE-2026-115810 — Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL (CVSS 7.7)
• CVE-2026-59970 — Tandoor Recipes: Blind SSRF via AI provider URL (api_base) (CVSS 7.7)
• CVE-2026-59966 — Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns (CVSS 5.7)
• CVE-2026-59963 — Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints (CVSS 7.1)
• CVE-2026-61726 — Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content (CVSS 8.1)
• CVE-2026-59967 — Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport (CVSS 5.4)
• CVE-2026-59962 — Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes (CVSS 6.5)
• CVE-2026-27460 — Tandoor Recipes Affected by Denial of Service via Recipe Import (CVSS 6.5)
• CVE-2026-35489 — Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` (CVSS 7.3)
• CVE-2026-35488 — Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users (CVSS 8.1)
• CVE-2026-35046 — Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) (CVSS 5.4)
• CVE-2026-35045 — Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification (CVSS 8.1)
• CVE-2026-33153 — Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic (CVSS 6.5)
• CVE-2026-33152 — Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication (CVSS 7.5)
• CVE-2026-33149 — Tandoor Recipes Vulnerable to Host Header Injection (CVSS 8.1)
• CVE-2026-33148 — URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key (CVSS 6.5)
• CVE-2026-29055 — Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII (CVSS 5.3)
• CVE-2026-28503 — Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 (CVSS 6.5)
• CVE-2026-25991 — Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import (CVSS 7.7)
• CVE-2026-25964 — Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read (CVSS 4.9)
• CVE-2025-57396 — (CVSS 6.5)
• CVE-2025-23213 — Tandoor Recipes - Stored XSS through Unrestricted File Upload (CVSS 5.4)
• CVE-2025-23212 — Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server (CVSS 6.5)
• CVE-2025-23211 — Tandoor Recipes - SSTI - Remote Code Execution (CVSS 9.9)
• CVE-2024-0403 — Recipes 1.5.10 - Blind SSRF (CVSS 6.5)