Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 1 of 2
Oct 23, 2026Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale groupCVE-2026-112342 · Other software · Tandoor Recipes · reported by VulnCheckHigh 7.1
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
- Product
- Tandoor Recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to forceCVE-2026-115810 · Other software · TandoorRecipes · reported by VulnCheckMedium 6.3
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026conda-forge is a GitHub organization containing repositories of conda recipes.CVE-2026-55422 · Other software · conda-forge · reported by GitHubMedium 4.6
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency). JSON files are produced automatically by the conda-forge autotick bot (regro/cf-scripts) while it processes every conda-forge feedstock and its upstream source artifacts. The error/status strings embed raw output captured from those processes (build logs, patch output, tracebacks). The website renders them verbatim as HTML. At time of publication, there are no publicly available patches.
- Product
- conda-forge.github.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Tasty Recipes Lite: Does not correctly check user capabilitiesCVE-2026-110026 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.
- Product
- Tasty Recipes Lite
- Fixed in
- 1.2.11
- What to do
- Update Tasty Recipes Lite to 1.2.11 or newer.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-61726 · Other software · TandoorRecipes · reported by GitHubHigh 8.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59970 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59966 · Other software · TandoorRecipes · reported by GitHubMedium 5.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59963 · Other software · TandoorRecipes · reported by GitHubHigh 7.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59967 · Other software · TandoorRecipes · reported by GitHubMedium 5.4
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59962 · Other software · TandoorRecipes · reported by GitHubMedium 6.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the idCVE-2026-108594 · Other software · mealie-recipes · reported by VulnCheckLow 2.3
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
- Product
- mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026A weakness has been identified in mealie-recipes Mealie up to 3.25.1.CVE-2026-94028 · Other software · mealie-recipes · reported by VulDBLow 2.1
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratingsCVE-2026-93736 · Other software · mealie-recipes · reported by VulnCheckMedium 5.3
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
- Product
- mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, CVE-2026-71210 · Other software · mealie-recipes · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 5.3
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.
- Product
- mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure.CVE-2026-47619 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.6
NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- Product
- Dynamo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 3, 2026python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-69249 · Other software · pyca · reported by GitHubHigh 8.7
python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-69248 · Other software · pyca · reported by GitHubMedium 6.9
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-69247 · Other software · pyca · reported by GitHubHigh 8.2
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Delicious Recipes: Stored Cross-Site ScriptingCVE-2026-15099 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.
- Product
- Delicious Recipes
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Delicious Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.CVE-2026-57663 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
- What to do
- Update the plugin to the newest version.
Apr 10, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-27460 · Other software · TandoorRecipes · reported by GitHubMedium 6.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly degrade its performance by uploading a large size ZIP file (ZIP Bomb). This vulnerability is fixed in 2.6.5.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-39892 · Other software · pyca · reported by GitHubMedium 6.9
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Apr 7, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-35489 · Other software · TandoorRecipes · reported by GitHubHigh 7.3
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-35488 · Other software · TandoorRecipes · reported by GitHubHigh 8.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-35046 · Other software · TandoorRecipes · reported by GitHubMedium 5.4
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-35045 · Other software · TandoorRecipes · reported by GitHubHigh 8.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses all object-level authorization checks enforced on standard single-recipe endpoints (PUT /api/recipe/{id}/), enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. This vulnerability is fixed in 2.6.4.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-34073 · Other software · pyca · reported by GitHubLow 1.7
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-33153 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's `DEBUG=False` (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-33152 · Other software · TandoorRecipes · reported by GitHubCritical 9.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-33149 · Other software · TandoorRecipes · reported by GitHubHigh 8.1
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-33148 · Other software · TandoorRecipes · reported by GitHubMedium 6.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied `query` parameter into the URL string without URL-encoding. An attacker can inject additional URL parameters by including `&` characters in the query value. This allows overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500) via malformed requests — a Denial of Service condition. Version 2.6.0 patches the issue.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-29055 · Other software · TandoorRecipes · reported by GitHubMedium 5.3
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the image processing pipeline in Tandoor Recipes explicitly skips EXIF metadata stripping, image rescaling, and size validation for WebP and GIF image formats. A developer TODO comment in the source code acknowledges this as a known issue. As a result, when users upload recipe photos in WebP format (the default format for modern smartphone cameras), their sensitive EXIF data — including GPS coordinates, camera model, timestamps, and software information — is stored and served to all users who can view the recipe. Version 2.6.0 fixes the issue.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-28503 · Other software · TandoorRecipes · reported by GitHubMedium 5.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_folder()` action in `cookbook/views/api.py` (line 903) fetches a Sync object using `get_object_or_404(Sync, pk=pk)` without including `space=request.space` in the filter. This allows an admin user in Space A to trigger sync operations (Dropbox/Nextcloud/Local import) on Sync configurations belonging to Space B, and view the resulting sync logs. Version 2.6.0 patches the issue.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-25991 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-25964 · Other software · TandoorRecipes · reported by GitHubMedium 4.9
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This vulnerability stems from a lack of input validation in the file_path parameter and insufficient checks in the Local storage backend, enabling an attacker to bypass storage directory restrictions and access sensitive system files (e.g., /etc/passwd) or application configuration files (e.g., settings.py), potentially leading to full system compromise. This vulnerability is fixed in 2.5.1.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2026-26007 · Other software · pyca · reported by GitHubHigh 8.2
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.
- Product
- cryptography
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Tandoor Recipes is a recipe manager than can be installed with the Nix package manager.CVE-2026-23838 · Other software · NixOS · reported by GitHubHigh 8.7
Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move
- Product
- nixpkgs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62131 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2025WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file uploads when importing recipesCVE-2025-11755 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 19, 2025Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation.CVE-2025-57396 · Other software · Tandoor · reported by MITREMedium 6.5
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escalate their privileges to the highest level.
- Product
- Recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.
- Product
- Recipes manager - WPH
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery (CSRF)CVE-2025-32555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.
- Product
- SEO, Nutrition and Print for Recipes by Edamam
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update SEO, Nutrition and Print for Recipes by Edamam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Boo Recipes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31759 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BooSpot Boo Recipes boo-recipes allows Stored XSS.This issue affects Boo Recipes: from n/a through <= 2.4.1.
- Product
- Boo Recipes
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Boo Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Yummly Rich Recipes: Cross-Site Request Forgery (CSRF)CVE-2025-30549 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.
- Product
- Yummly Rich Recipes
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Yummly Rich Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23213 · Other software · TandoorRecipes · reported by GitHubHigh 8.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23212 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23211 · Other software · TandoorRecipes · reported by GitHubCritical 9.9
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Delicious Recipes – WordPress Recipe: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43935 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes – WordPress Recipe Plugin allows Stored XSS.This issue affects Delicious Recipes – WordPress Recipe Plugin: from n/a through 1.6.7.
- Product
- Delicious Recipes – WordPress Recipe
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Delicious Recipes – WordPress Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.