TTandoorRecipes

Products

Exploited and recent CVEs

• CVE-2026-115810 High 7.7 Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL 0.4%
• CVE-2026-59970 High 7.7 Tandoor Recipes: Blind SSRF via AI provider URL (api_base) 0.3%
• CVE-2026-61726 High 8.1 Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content 0.3%
• CVE-2026-59966 Medium 5.7 Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns 0.3%
• CVE-2026-59963 High 7.1 Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints 0.2%
• CVE-2026-59962 Medium 6.5 Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes 0.3%
• CVE-2026-59967 Medium 5.4 Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport 0.3%
• CVE-2026-27460 Medium 6.5 Tandoor Recipes Affected by Denial of Service via Recipe Import 0.3%
• CVE-2026-35489 High 7.3 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` 0.2%
• CVE-2026-35488 High 8.1 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users 0.4%
• CVE-2026-35046 Medium 5.4 Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) 0.2%
• CVE-2026-35045 High 8.1 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification 0.3%
• CVE-2026-33152 Critical 9.1 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication 0.5%
• CVE-2026-33153 High 7.7 Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic 0.5%
• CVE-2026-33148 Medium 6.5 URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key 0.5%
• CVE-2026-29055 Medium 5.3 Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII 0.3%
• CVE-2026-28503 Medium 5.5 Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 0.3%
• CVE-2026-33149 High 8.1 Tandoor Recipes Vulnerable to Host Header Injection 0.3%
• CVE-2026-25991 High 7.7 Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import 0.3%
• CVE-2026-25964 Medium 4.9 Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read 0.5%
• CVE-2025-23213 High 8.7 Tandoor Recipes - Stored XSS through Unrestricted File Upload 0.4%
• CVE-2025-23212 High 7.7 Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server 0.5%
• CVE-2025-23211 Critical 10.0 Tandoor Recipes - SSTI - Remote Code Execution 3.7%