recipes

Tandoor Recipes versions from 2.0.0 up to but not including 2.7.0 contain a server-side request forgery (SSRF) vulnerability in the Pestle importer. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files that cause the server to issue arbitrary GET requests. The vulnerability arises from a raw requests.get call that bypasses the application's centralized SSRF protections, enabling attackers to access internal-only endpoints, perform port and service discovery, and exfiltrate internal responses via stored recipe images.

CVE-2026-115810 is a server-side request forgery vulnerability in Tandoor Recipes before version 2.7.0, specifically in the Pestle importer component. Authenticated users with low privileges can exploit this by embedding malicious image URLs in Pestle JSON import files. The vulnerability stems from the use of a raw requests.get call in cookbook/integration/pestle.py, which circumvents the application's centralized SSRF filter. This allows attackers to make the server send GET requests to arbitrary internal or external hosts, potentially reaching internal-only endpoints, conducting port and service discovery, and exfiltrating internal responses through stored recipe images.

CVE Database V5

Tandoor Recipes versions from 2.0.0 up to but not including 2.7.0 contain a server-side request forgery (SSRF) vulnerability in the Pestle importer. This flaw allows authenticated low-privileged users to craft malicious image URLs in Pestle JSON import files that cause the server to issue arbitrary 

CVE-2026-115810: Server-Side Request Forgery (SSRF) in TandoorRecipes recipes

node

A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snapshot creation, the cached random values are reused across processes started from that snapshot, causing collisions and predictability of supposedly unique identifiers. This impacts Node.js versions 22.23.3, 24.22.0, and 26.12.0.

CVE-2026-106074 is a vulnerability in Node.js where the internal entropy caches for crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() are saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. When these functions or dependent APIs like URL.createObjectURL() are invoked during snapshot creation, the cached random values are reused in every process started from that snapshot until the cache is refilled. This results in up to 127 UUIDs and about 1,000 randomInt() values being identical across processes, leading to collisions of identifiers expected to be unique and predictability of values across processes. The affected versions are Node.js 22.23.3, 24.22.0, and 26.12.0.

A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snaps

CVE-2026-106074: CWE-330 Use of Insufficiently Random Values in nodejs node

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these restrictions and access filesystem paths outside permitted directories. The vulnerability has a low severity score and does not impact integrity or availability.

CVE-2026-106073 is a vulnerability in Node.js affecting versions 22.23.3, 24.22.0, and 26.12.0. The issue arises because fs.realpathSync() lacks proper read permission enforcement under the Node.js permission model, allowing code running with restricted --allow-fs-read permissions to check file existence, resolve symbolic link targets, and enumerate filesystem paths outside allowed directories. This is an incomplete fix of CVE-2026-21715, which only addressed fs.realpathSync.native(). The vulnerability has a CVSS 3.0 base score of 3.3 (low severity) with local attack vector, low complexity, low privileges required, no user interaction, and limited confidentiality impact.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these r

CVE-2026-106073: CWE-284 Improper Access Control - Generic in nodejs node

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can authenticate IP endpoints if the client uses non-canonical IPv4 address spellings. This occurs because tls.checkServerIdentity() normalizes these addresses and matches them against DNS names, allowing improper validation. Exploitation requires a trusted CA to issue a certificate with a numeric DNS SAN and a platform resolver that accepts non-canonical IP formats.

CVE-2026-106072 is a vulnerability in Node.js TLS hostname verification (CWE-295) affecting versions 22.23.3, 24.22.0, and 26.12.0. The flaw allows a certificate containing only a DNS SAN with a numeric IP address to authenticate an IP endpoint when the client connects using non-canonical IPv4 spellings such as octal, hexadecimal, or integer formats. The function tls.checkServerIdentity() fails to classify these hosts as IP addresses and instead normalizes them to canonical form and matches against DNS names. This leads to acceptance of certificates with DNS:127.0.0.1 but no IP Address SAN for 127.0.0.1, which should be rejected. Exploitation requires a certificate from a trusted CA and a platform resolver like glibc that accepts these non-canonical IP spellings.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can authenticate IP endpoints if the client uses non-canonical IPv4 address spellings. This occurs because tls.checkServerIdentity() n

CVE-2026-106072: CWE-295 Improper Certificate Validation in nodejs node

CVE-2026-106071 is a low-severity vulnerability in Node.js 26.x where the filesystem permission model improperly enforces wildcard path grants. Specifically, a wildcard rule such as --allow-fs-read=/etc/passwd.* can incorrectly allow access to /etc/passwd itself due to early termination in the radix tree lookup. This flaw requires the wildcard grant to be directly under the root of the permission tree and differs from CVE-2026-58043. The vulnerability has a CVSS score of 3.6 and affects Node.js version 26.12.0.

This vulnerability arises from improper access control in Node.js's permission model for filesystem access. When a wildcard permission is granted (e.g., --allow-fs-read=/etc/passwd.*), the radix tree lookup used to verify paths stops comparing early if the requested path is shorter than the wildcard prefix. This causes paths that should not match the wildcard to be incorrectly allowed, such as /etc/passwd being accessible when only /etc/passwd.* was intended. The issue requires the wildcard grant to be directly under the root of the permission tree and is distinct from a separate vulnerability (CVE-2026-58043). The flaw affects Node.js version 26.12.0.

CVE-2026-106071 is a low-severity vulnerability in Node.js 26.x where the filesystem permission model improperly enforces wildcard path grants. Specifically, a wildcard rule such as --allow-fs-read=/etc/passwd.* can incorrectly allow access to /etc/passwd itself due to early termination in the radix

CVE-2026-106071: CWE-284 Improper Access Control - Generic in nodejs node

CVE-2026-49156 has been rejected or withdrawn by its CVE Numbering Authority and does not represent a valid or recognized vulnerability.

The identifier CVE-2026-49156 was assigned but subsequently rejected or withdrawn by the CVE Numbering Authority. As a result, it is not a valid CVE and does not correspond to any confirmed security vulnerability.

GCVE Database

Detailed information about Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-49156). Get real-time updates, 

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-49156) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-49156

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional