Mealie

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 17
    Known Exploited: 0
    2
    Critical Level Threats
    1
    High Level Threats
    12
    Medium Level Threats
    2
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2026-108594

    Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

    Last Modified: Oct 14, 2026
    Published: Oct 10, 2026

    CVE-2026-94028

    mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

    Last Modified: Sep 21, 2026
    Published: Sep 20, 2026

    CVE-2026-93736

    Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

    Last Modified: Sep 18, 2026
    Published: Sep 18, 2026

    CVE-2025-70296

    A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.

    Last Modified: Feb 23, 2026
    Published: Feb 11, 2026

    CVE-2025-70297

    A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser.

    Last Modified: Feb 23, 2026
    Published: Feb 11, 2026
    Items Per Page
    Mealie Vulnerabilities & Security CVEs | CVE-DB