CVE-2026-25991

CVE-2026-25991 PoC - Tandoor Recipes SSRF Proof-of-Concept for SSRF via Recipe Import Disclosure: Originally reported by me via GHSA-j6xg-85mh-qqf7 ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID| CVE-2026-25991 Severity| 🔴 High CVSS Score| 7.7 CVS...

CVE-2026-25964

CVE-2026-25964 PoC - Tandoor Recipes Authenticated LFI Proof-of-Concept for Authenticated Local File Disclosure via Recipe Import Disclosure: Originally reported by me via GHSA-6485-jr28-52xx ⚠️ Authorized pentesting/research use only. Vulnerability Information Field| Value ---|--- CVE ID|...

CVE-2026-111899

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

EUVD-2026-104319

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899

KitchenOwl versions through 0.7.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the recipe import functionality. The flaw allows authenticated household members to bypass IP filtering by exploiting an unfiltered fetch. Specifically, an attacker can host a page titled KitchenOwl a...

PT-2026-117394

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/. The follow-up requests.get call...

CVE-2026-111899: Server-Side Request Forgery (SSRF)

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/ . The follow-up requests.get cal...

PT-2026-116140

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

CVE-2026-27460

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service DoS vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly...

CVE-2026-27460 Tandoor Recipes Affected by Denial of Service via Recipe Import

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service DoS vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly...

EUVD-2026-21549

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service DoS vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly...

CVE-2026-27460

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service DoS vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly...

PT-2026-32018

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.6.5 Description Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to version 2.6.5, a Denial of Service DoS issue exists in the recipe import...

CVE-2026-27460: Improper Handling of Highly Compressed Data (Data Amplification)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service DoS vulnerability was in the recipe import functionality. This vulnerability allows an authenticated user to crash the server or make a significantly...

Exploit for External Control of File Name or Path in Tandoor Recipes

CVE-2026-25964 PoC - Tandoor Recipes Authenticated LFI Proo...

CVE-2026-25964

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This...

CVE-2026-25964

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the server. This...