https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 03:03:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35046 <p><strong>Affected:</strong> TandoorRecipes recipes</p> <p>Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary &lt;style&gt; tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the &lt;style&gt; tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.</p> <p><strong>Affected:</strong> TandoorRecipes recipes</p> <p>Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary &lt;style&gt; tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the &lt;style&gt; tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-35046