Vulnerabilities in TandoorRecipes
23 resultsCVE-2025-23211CRITICALTandoor Recipes - SSTI - Remote Code ExecutionEPSS 3.7%CVE-2025-23212HIGHTandoor Recipes - Local file disclosure - Users can read the content of any file on the serverEPSS 0.5%CVE-2026-33152CRITICALTandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthenticationEPSS 0.5%CVE-2026-25964MEDIUMTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File ReadEPSS 0.5%CVE-2026-33148MEDIUMURL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API KeyEPSS 0.5%CVE-2026-33153HIGHTandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control LogicEPSS 0.5%CVE-2026-35488HIGHTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) usersEPSS 0.4%CVE-2026-115810MEDIUMTandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URLEPSS 0.4%CVE-2025-23213HIGHTandoor Recipes - Stored XSS through Unrestricted File UploadEPSS 0.4%CVE-2026-59962MEDIUMTandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor RecipesEPSS 0.3%CVE-2026-25991HIGHTandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe ImportEPSS 0.3%CVE-2026-59966MEDIUMTandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex PatternsEPSS 0.3%CVE-2026-29055MEDIUMTandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PIIEPSS 0.3%CVE-2026-28503MEDIUMTandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404EPSS 0.3%CVE-2026-59970HIGHTandoor Recipes: Blind SSRF via AI provider URL (api_base)EPSS 0.3%CVE-2026-27460MEDIUMTandoor Recipes Affected by Denial of Service via Recipe ImportEPSS 0.3%CVE-2026-33149HIGHTandoor Recipes Vulnerable to Host Header InjectionEPSS 0.3%CVE-2026-61726HIGHTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe contentEPSS 0.3%CVE-2026-59967MEDIUMTandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImportEPSS 0.3%CVE-2026-35045HIGHTandoor Recipes Affected by Private Recipe Exposure and Unauthorized ModificationEPSS 0.3%