Browse CVEs

MEDIUM 6.1 CVE-2025-70297 A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated … Mealie 3.6.0+ Fix from $1,6002026-02-11 MEDIUM 5.4 CVE-2025-70296 A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary H… Mealie 3.8.0+ Fix from $1,6002026-02-11 CRITICAL 9.0 CVE-2025-56795 Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note… Mealie after 3.0.1 Fix from $2,3002025-09-29 HIGH 7.6 CVE-2024-55073 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profi… Mealie No fix yet Fix from $1,9502025-03-27 MEDIUM 5.4 CVE-2024-55072 A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profi… Mealie No fix yet Fix from $1,6002025-03-27 MEDIUM 6.5 CVE-2024-31994 Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie… Mealie 1.4.0+ Fix from $1,6002024-04-19 MEDIUM 6.5 CVE-2024-31992 Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a requ… Mealie 1.4.0+ Fix from $1,6002024-04-19 CRITICAL 9.8 CVE-2022-34615 Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-forc… Mealie Mitigation only Fix from $2,3002022-08-19 MEDIUM 6.5 CVE-2022-34621 Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords … Mealie Mitigation only Fix from $1,6002022-08-19 MEDIUM 5.9 CVE-2022-34624 Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET… Mealie Mitigation only Fix from $1,6002022-08-19 MEDIUM 5.3 CVE-2022-32425 The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. Mealie Mitigation only Fix from $1,6002022-07-14