kitchenowl vulnerabilities
CVEs whose affected-version data names the kitchenowl package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111899Medium· 4.3KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl…
▾ SunlitTomBursch · kitchenowlEPSS 0.27%via CVEORG
CVE-2026-101033Medium· 4.3KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, …
▾ SunlitTomBursch · kitchenowlEPSS 0.22%via NVD