Tandoor Recipes
22 CVEs affecting Tandoor Recipes. Latest disclosed: 2026-04-10. Critical: 2, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23211 | Critical | 9.9 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute com… |
CVE-2026-33152 | Critical | 9.1 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Dja… |
CVE-2025-23213 | High | 8.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files… |
CVE-2026-35488 | High | 8.1 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewS… |
CVE-2026-35045 | High | 8.1 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint… |
CVE-2026-33149 | High | 8.1 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*'… |
CVE-2026-25991 | High | 7.7 | 2026-02-13 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forge… |
CVE-2025-23212 | High | 7.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate… |
CVE-2026-35489 | High | 7.3 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint… |
CVE-2026-27460 | Medium | 6.5 | 2026-04-10 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnera… |
CVE-2026-33153 | Medium | 6.5 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint expose… |
CVE-2026-33148 | Medium | 6.5 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central… |
CVE-2026-28503 | Medium | 6.5 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_… |
CVE-2025-57396 | Medium | 6.5 | 2025-09-19 | Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User… |
CVE-2024-0403 | Medium | 6.5 | 2024-03-01 | Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF. |
CVE-2022-23071 | Medium | 6.5 | 2022-06-19 | In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters th… |
CVE-2026-35046 | Medium | 5.4 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users… |
CVE-2026-29055 | Medium | 5.3 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline… |
CVE-2026-25964 | Medium | 4.9 | 2026-02-13 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the Reci… |
CVE-2022-23074 | | 2022-06-21 | In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a… |