TI-2026-25582 CVE-2026-33152
Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication
Priority HIGH 80
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TandoorRecipes
Records29All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9
Exploited now
TandoorRecipes records in CISA KEVNo TandoorRecipes vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
22 records in Recipes · all components
TI-2025-16996 CVE-2025-23211
Tandoor Recipes - SSTI - Remote Code Execution
Priority HIGH 76
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-25583 CVE-2026-33153
SQL injection in TandoorRecipes recipes
Priority HIGH 73
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-27618 CVE-2026-35489
Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`
Priority HIGH 71
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Priority HIGH 71
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-27248 CVE-2026-35045
Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
Priority HIGH 70
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Priority HIGH 70
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-27617 CVE-2026-35488
Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
Priority HIGH 68
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-21006 CVE-2026-25991
Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import
Priority HIGH 67
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2025-16997 CVE-2025-23212
Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server
Priority HIGH 67
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-23200 CVE-2026-29055
Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII
Priority MEDIUM 63
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-25578 CVE-2026-33148
URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key
Priority MEDIUM 62
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
Priority MEDIUM 62
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-27249 CVE-2026-35046
Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)
Priority MEDIUM 58
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2026-20989 CVE-2026-25964
Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read
Priority MEDIUM 56
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2024-00365 CVE-2024-0403 · GHSA-92x5-9q2r-x8gq
Recipes 1.5.10 - Blind SSRF
Priority LOW 35
Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server.
TI-2026-22766 CVE-2026-28503
Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404
Priority LOW 31
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.
TI-2022-07242 CVE-2022-23071 · GHSA-pc7x-r4c4-7qqw
Recipes - SSRF on Import
Priority LOW 31
In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality.
TI-2025-35528 CVE-2025-57396 · GHSA-x42r-cvgx-rqgp
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege…
Priority LOW 30
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation.
TI-2022-07245 CVE-2022-23074 · GHSA-f78f-957j-7jxh
Recipes - Stored XSS in Name Parameter
Priority LOW 18
In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components.
TI-2022-07244 CVE-2022-23073 · GHSA-67q5-2qcj-6mph
Recipes - Stored XSS in Clipboard
Priority LOW 18
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality.
TI-2022-07243 CVE-2022-23072 · GHSA-jwqf-wr86-3pxv
Recipes - Stored XSS in Add to Cart
Priority LOW 18
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality.