en
mealie-recipes is the open-source project community that develops and maintains Mealie, a self-hosted application for managing recipes and planning meals. It operates in the open-source and self-hosted software space, supporting households and individual operators through community-developed code and project resources.
As of 09/30/2026, mealie-recipes recorded 3 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, mealie had the most security vulnerabilities in the mealie-recipes ecosystem, with 3 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-94028mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery | Exploitation statusPublic exploit | FixYes | Affected productmealie | Published09/20/2026 | SeverityMedium |
CVE-2026-93736Mealie before 3.21.0 Information Disclosure via Ratings Endpoint | Exploitation statusPublic exploit | FixYes | Affected productmealie | Published09/18/2026 | SeverityMedium |
CVE-2026-71210mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access | Exploitation statusNot known exploited | FixNot confirmed | Affected productmealie | Published08/05/2026 | SeverityMedium |
CVE-2024-31994Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228) | Exploitation statusNot known exploited | FixYes | Affected productmealie | Published04/19/2024 | SeverityMedium |
CVE-2024-31993Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) | Exploitation statusPublic exploit | FixYes | Affected productmealie | Published04/19/2024 | SeverityMedium |
CVE-2024-31992Mealie contains a DoS vulnerability in recipe importer | Exploitation statusNot known exploited | FixYes | Affected productmealie | Published04/19/2024 | SeverityMedium |
CVE-2024-31991Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225) | Exploitation statusNot known exploited | FixYes | Affected productmealie | Published04/19/2024 | SeverityMedium |
