TandoorRecipes vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202620

Newest CVEs

• CVE-2026-115810

  Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL

  TandoorRecipes · recipes

  Medium6.3
• CVE-2026-59970

  Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

  TandoorRecipes · recipes

  High7.7
• CVE-2026-61726

  Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

  TandoorRecipes · recipes

  High8.1
• CVE-2026-59966

  Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

  TandoorRecipes · recipes

  Medium5.7
• CVE-2026-59963

  Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

  TandoorRecipes · recipes

  High7.1
• CVE-2026-59962

  Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

  TandoorRecipes · recipes

  Medium6.5
• CVE-2026-59967

  Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

  TandoorRecipes · recipes

  Medium5.4
• CVE-2026-27460

  Tandoor Recipes Affected by Denial of Service via Recipe Import

  TandoorRecipes · recipes

  Medium6.5
• CVE-2026-35489

  Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

  TandoorRecipes · recipes

  High7.3
• CVE-2026-35488

  Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

  TandoorRecipes · recipes

  High8.1