Tandoor Recipes - SSTI - Remote Code Execution

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

Tandoor Recipes Vulnerable to Host Header Injection

Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import

Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Tandoor Recipes Affected by Denial of Service via Recipe Import

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)

Tandoor Recipes - Stored XSS through Unrestricted File Upload

Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read