# recipes.

Every CVE that names recipes among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL](https://agentprime.io/advisories/CVE-2026-115810.md)
  `CVE-2026-115810` · CVE record: TandoorRecipes recipes · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Tandoor Recipes: Blind SSRF via AI provider URL (api_base)](https://agentprime.io/advisories/CVE-2026-59970.md)
  `CVE-2026-59970` · CVE record: TandoorRecipes recipes · CVSS 7.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content](https://agentprime.io/advisories/CVE-2026-61726.md)
  `CVE-2026-61726` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns](https://agentprime.io/advisories/CVE-2026-59966.md)
  `CVE-2026-59966` · CVE record: TandoorRecipes recipes · CVSS 5.7 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints](https://agentprime.io/advisories/CVE-2026-59963.md)
  `CVE-2026-59963` · CVE record: TandoorRecipes recipes · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes](https://agentprime.io/advisories/CVE-2026-59962.md)
  `CVE-2026-59962` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Other injection
- [Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport](https://agentprime.io/advisories/CVE-2026-59967.md)
  `CVE-2026-59967` · CVE record: TandoorRecipes recipes · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tandoor Recipes Affected by Denial of Service via Recipe Import](https://agentprime.io/advisories/CVE-2026-27460.md)
  `CVE-2026-27460` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-409
- [Tandoor Recipes — \`amount\`/\`unit\` bypass serializer in \`food/{id}/shopping/\`](https://agentprime.io/advisories/CVE-2026-35489.md)
  `CVE-2026-35489` · CVE record: TandoorRecipes recipes · CVSS 7.3 High · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control, CWE-1284
- [Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users](https://agentprime.io/advisories/CVE-2026-35488.md)
  `CVE-2026-35488` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-749
- [Tandoor has a Stored CSS Injection via \<style> Tag in Recipe Instructions (API-Level)](https://agentprime.io/advisories/CVE-2026-35046.md)
  `CVE-2026-35046` · CVE record: TandoorRecipes recipes · CVSS 5.4 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification](https://agentprime.io/advisories/CVE-2026-35045.md)
  `CVE-2026-35045` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: Broken access control
- [Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication](https://agentprime.io/advisories/CVE-2026-33152.md)
  `CVE-2026-33152` · CVE record: TandoorRecipes recipes · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Authentication bypass
- [Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic](https://agentprime.io/advisories/CVE-2026-33153.md)
  `CVE-2026-33153` · CVE record: TandoorRecipes recipes · CVSS 7.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: SQL injection
- [URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key](https://agentprime.io/advisories/CVE-2026-33148.md)
  `CVE-2026-33148` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Other injection
- [Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII](https://agentprime.io/advisories/CVE-2026-29055.md)
  `CVE-2026-29055` · CVE record: TandoorRecipes recipes · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-1230
- [Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404](https://agentprime.io/advisories/CVE-2026-28503.md)
  `CVE-2026-28503` · CVE record: TandoorRecipes recipes · CVSS 5.5 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control
- [Tandoor Recipes Vulnerable to Host Header Injection](https://agentprime.io/advisories/CVE-2026-33149.md)
  `CVE-2026-33149` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-644
- [Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import](https://agentprime.io/advisories/CVE-2026-25991.md)
  `CVE-2026-25991` · CVE record: TandoorRecipes recipes · CVSS 7.7 High · Not analysed yet · Published 13 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-25964.md)
  `CVE-2026-25964` · CVE record: TandoorRecipes recipes · CVSS 4.9 Medium · Not analysed yet · Published 13 Feb 2026 · Tags: Path traversal
- [Tandoor Recipes - Stored XSS through Unrestricted File Upload](https://agentprime.io/advisories/CVE-2025-23213.md)
  `CVE-2025-23213` · CVE record: TandoorRecipes recipes · CVSS 8.7 High · Not analysed yet · Published 28 Jan 2025 · Tags: Unrestricted file upload
- [Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server](https://agentprime.io/advisories/CVE-2025-23212.md)
  `CVE-2025-23212` · CVE record: TandoorRecipes recipes · CVSS 7.7 High · Not analysed yet · Published 28 Jan 2025 · Tags: Information disclosure
- [Tandoor Recipes - SSTI - Remote Code Execution](https://agentprime.io/advisories/CVE-2025-23211.md)
  `CVE-2025-23211` · CVE record: TandoorRecipes recipes · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jan 2025 · Tags: Code injection
- [Recipes 1.5.10 - Blind SSRF](https://agentprime.io/advisories/CVE-2024-0403.md)
  `CVE-2024-0403` · CVE record: Recipes Recipes · CVSS 6.5 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: Server-side request forgery (SSRF)
- [Recipes - Stored XSS in Name Parameter](https://agentprime.io/advisories/CVE-2022-23074.md)
  `CVE-2022-23074` · CVE record: recipes recipes · No CVSS score · Not analysed yet · Published 21 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Recipes - Stored XSS in Clipboard](https://agentprime.io/advisories/CVE-2022-23073.md)
  `CVE-2022-23073` · CVE record: recipes recipes · No CVSS score · Not analysed yet · Published 21 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Recipes - Stored XSS in Add to Cart](https://agentprime.io/advisories/CVE-2022-23072.md)
  `CVE-2022-23072` · CVE record: recipes recipes · No CVSS score · Not analysed yet · Published 21 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Recipes - SSRF on Import](https://agentprime.io/advisories/CVE-2022-23071.md)
  `CVE-2022-23071` · CVE record: recipes recipes · No CVSS score · Not analysed yet · Published 19 Jun 2022 · Tags: Server-side request forgery (SSRF)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=recipes>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/recipes/>. Everything for agents: <https://agentprime.io/llms.txt>.