Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

recipes — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in recipes, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumerations (CWE) affecting the recipe software product category across various vendors. It focuses on security flaws specific to applications that manage, store, or retrieve culinary instructions, ingredient data, and cooking preferences. The vulnerability data collected here encompasses a wide range of issues, including cross-site scripting, SQL injection, and path traversal attacks, primarily impacting web-based recipe platforms and associated mobile applications. The time range covered spans from early 2018 to the present, providing a comprehensive historical view of emerging threats and their evolution within this niche sector. This period captures significant shifts in how recipe data is handled, reflecting changes in technology stacks and user interaction models. Visitors to this aggregation can effectively track vendor security advisories to stay informed about patch requirements for specific recipe tools. Users may also explore the characteristics of common weakness classes to better understand the underlying technical causes of vulnerabilities. Furthermore, the page allows for looking up a specific product’s vulnerability history, enabling developers and security analysts to assess risk profiles and identify recurring patterns in code quality or design flaws. By consolidating these disparate reports, the resource offers a clearer perspective on the security landscape for recipe-related software, supporting more informed decision-making during development and maintenance phases without requiring manual cross-referencing of multiple sources.

Vendor: recipes

CVE IDTitleCVSSSeverityPublished
CVE-2026-27460 Tandoor Recipes Affected by Denial of Service via Recipe Import CWE-409 6.5 Medium2026-04-10
CVE-2026-35489 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` CWE-639 7.3 High2026-04-07
CVE-2026-35488 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users CWE-749 8.1 High2026-04-07
CVE-2026-35046 Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) CWE-79 5.4 Medium2026-04-06
CVE-2026-35045 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification CWE-639 8.1 High2026-04-06
CVE-2026-33152 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication CWE-307 9.1 Critical2026-03-26
CVE-2026-33153 Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic CWE-89 6.5 -2026-03-26
CVE-2026-33148 URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key CWE-74 6.5 Medium2026-03-26
CVE-2026-29055 Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII CWE-1230 5.3 Medium2026-03-26
CVE-2026-28503 Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 CWE-639 6.5 -2026-03-26
CVE-2026-33149 Tandoor Recipes Vulnerable to Host Header Injection CWE-644 8.1 High2026-03-26
CVE-2026-25991 Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import CWE-918 7.7 High2026-02-13
CVE-2026-25964 Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read CWE-22 4.9 Medium2026-02-13
CVE-2025-23213 Tandoor Recipes - Stored XSS through Unrestricted File Upload CWE-434 8.7 High2025-01-28
CVE-2025-23212 Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server CWE-200 7.7 High2025-01-28
CVE-2025-23211 Tandoor Recipes - SSTI - Remote Code Execution CWE-1336 10.0 Critical2025-01-28
CVE-2024-0403 Recipes 1.5.10 - Blind SSRF CWE-918 6.5 Medium2024-02-29
CVE-2022-23074 Recipes - Stored XSS in Name Parameter CWE-79 5.4 -2022-06-21
CVE-2022-23073 Recipes - Stored XSS in Clipboard CWE-79 5.4 -2022-06-21
CVE-2022-23072 Recipes - Stored XSS in Add to Cart CWE-79 5.4 -2022-06-21
CVE-2022-23071 Recipes - SSRF on Import CWE-918 6.5 -2022-06-19

All 21 known CVE vulnerabilities affecting recipes with full Chinese analysis, references, and POCs where available.