TandoorRecipes has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 7.1 (high). None have a confirmed exploitation report. The most common weakness class is CWE-639 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Weakness classes
Products
- recipes 7
Worst active — by depth score
CVE-2026-61726High· 8.1Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content57CVE-2026-59970High· 7.7Tandoor Recipes: Blind SSRF via AI provider URL (api_base)54CVE-2026-59962Medium· 6.5Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists48CVE-2026-59966Medium· 5.7Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns43CVE-2026-115810High· 7.7Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL42
TandoorRecipes vulnerabilities
CVEs affecting TandoorRecipes, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-115810High· 7.7Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by …
CVE-2026-59963High· 7.1Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permis…
CVE-2026-61726High· 8.1PoCTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the pri…
CVE-2026-59970High· 7.7PoCTandoor Recipes: Blind SSRF via AI provider URL (api_base)
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request S…
CVE-2026-59966Medium· 5.7PoCTandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or a…
CVE-2026-59962Medium· 6.5PoCTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user suppl…
CVE-2026-59967Medium· 5.4PoCTandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requ…