TA
Vendor
TandoorRecipes
23
CVEs
0
On KEV
7
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115810 New | RE recipes TandoorRecipes | 7.7 | Oct 23 | Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL |
| CVE-2026-59970 | RE recipes TandoorRecipes | 7.7 | Oct 16 | Tandoor Recipes: Blind SSRF via AI provider URL (api_base) |
| CVE-2026-61726 | RE recipes TandoorRecipes | 8.1 | Oct 16 | Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content |
| CVE-2026-59966 | RE recipes TandoorRecipes | 5.7 | Oct 16 | Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns |
| CVE-2026-59963 | RE recipes TandoorRecipes | 7.1 | Oct 16 | Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints |
| CVE-2026-59962 | RE recipes TandoorRecipes | 6.5 | Oct 16 | Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes |
| CVE-2026-59967 | RE recipes TandoorRecipes | 5.4 | Oct 16 | Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport |
| CVE-2026-27460 | RE recipes TandoorRecipes | 6.5 | Apr 10 | Tandoor Recipes Affected by Denial of Service via Recipe Import |
| CVE-2026-35489 | RE recipes TandoorRecipes | 7.3 | Apr 7 | Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` |
| CVE-2026-35488 | RE recipes TandoorRecipes | 8.1 | Apr 7 | Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users |
| CVE-2026-35046 | RE recipes TandoorRecipes | 5.4 | Apr 6 | Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) |
| CVE-2026-35045 | RE recipes TandoorRecipes | 8.1 | Apr 6 | Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification |
| CVE-2026-33152 | RE recipes TandoorRecipes | 7.5 | Mar 26 | Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication |
| CVE-2026-33153 | RE recipes TandoorRecipes | 6.5 | Mar 26 | Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic |
| CVE-2026-33148 | RE recipes TandoorRecipes | 6.5 | Mar 26 | URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key |
| CVE-2026-29055 | RE recipes TandoorRecipes | 5.3 | Mar 26 | Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII |
| CVE-2026-28503 | RE recipes TandoorRecipes | 6.5 | Mar 26 | Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 |
| CVE-2026-33149 | RE recipes TandoorRecipes | 8.1 | Mar 26 | Tandoor Recipes Vulnerable to Host Header Injection |
| CVE-2026-25991 | RE recipes TandoorRecipes | 7.7 | Feb 13 | Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import |
| CVE-2026-25964 | RE recipes TandoorRecipes | 4.9 | Feb 13 | Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read |
| CVE-2025-23213 | RE recipes TandoorRecipes | 5.4 | Jan 28 | Tandoor Recipes - Stored XSS through Unrestricted File Upload |
| CVE-2025-23212 | RE recipes TandoorRecipes | 6.5 | Jan 28 | Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server |
| CVE-2025-23211 | RE recipes TandoorRecipes | 9.9 | Jan 28 | Tandoor Recipes - SSTI - Remote Code Execution |