What’s Vulnerable › Products
kovidgoyal calibre vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your kovidgoyal calibre version is affected
Latest kovidgoyal calibre vulnerabilities
- CVE-2026-73249 — calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification (CVSS 7.5)
- CVE-2026-73248 — calibre: Bypass of Python template restrictions via nested `template()` leading to RCE (CVSS 8.5)
- CVE-2026-53511 — calibre: Arbitrary Code Execution in Template Formatter via Book Metadata (CVSS 8.5)
- CVE-2026-33206 — calibre has a path traversal vulnerability (CVSS 6.3)
- CVE-2026-33205 — calibre has Server-Side Request Forgery in ebook viewer backend (CVSS 5.5)
- CVE-2026-30853 — calibre has a Path Traversal Leading to Arbitrary File Write (CVSS 8.2)
- CVE-2026-27824 — calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing (CVSS 5.3)
- CVE-2026-27810 — calibre Vulnerable to HTTP Response Header Injection (CVSS 6.4)
- CVE-2026-26065 — calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution (CVSS 8.8)
- CVE-2026-26064 — calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution (CVSS 8.8)
- CVE-2026-25731 — Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export (CVSS 7.8)
- CVE-2026-25636 — calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution (CVSS 7.8)
- CVE-2026-25635 — calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution (CVSS 8.6)
- CVE-2025-64486 — calibre is vulnerable to arbitrary code execution when opening FB2 files (CVSS 9.3)
- CVE-2024-7009 — Calibre SQL Injection (CVSS 7.1)
- CVE-2024-7008 — Calibre Reflected Cross-Site Scripting (XSS) (CVSS 6.1)
- CVE-2024-6781 — Calibre Arbitrary File Read (CVSS 7.5)
- CVE-2023-46303 — (CVSS 7.5)
- CVE-2021-44686 — (CVSS 7.5)
- CVE-2011-4126 — (CVSS 8.1)
- CVE-2011-4125 — (CVSS 9.8)
- CVE-2011-4124 — (CVSS 9.8)
- CVE-2018-7889 — (CVSS 7.8)
- CVE-2016-10187 — (CVSS 5.5)