Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
56 results · page 1 of 2
Oct 19, 2026A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12.CVE-2026-112297 · Other software · ptbsare · reported by VulDBLow 2.1
A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- anx-calibre-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre.CVE-2026-105080 · Other software · C4illin · reported by MITRECritical 9.4
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
- Product
- ConvertX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026calibre is an e-book manager.CVE-2026-73249 · Other software · kovidgoyal · reported by GitHubHigh 7.5
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026calibre is an e-book manager.CVE-2026-73248 · Other software · kovidgoyal · reported by GitHubHigh 8.5
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026calibre is an e-book manager.CVE-2026-53511 · Other software · kovidgoyal · reported by GitHubHigh 8.5
calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2026A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6.CVE-2026-7714 · Other software · crocodilestick · reported by VulDBMedium 5.5
A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.py of the component Admin Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
- Product
- Calibre-Web-Automated
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 3, 2026A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6.CVE-2026-7713 · Other software · crocodilestick · reported by VulDBLow 2.1
A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.0.7 addresses this issue. The patch is identified as 9f50bb2c16160564c9f8777dc2ceed3eb95e4807. The affected component should be upgraded.
- Product
- Calibre-Web-Automated
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 3, 2026A vulnerability was identified in janeczku Calibre-Web up to 0.6.26.CVE-2026-7709 · Other software · janeczku · reported by VulDBLow 2.1
A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Calibre-Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Mar 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-33206 · Other software · kovidgoyal · reported by GitHubHigh 8.2
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the file system into the converted book. Additionally, missing authentication and server-side request forgery in the background-image endpoint in the ebook reader web view allow the files to be exfiltrated without additional interaction. Version 9.6.0 contains a fix.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-33205 · Other software · kovidgoyal · reported by GitHubMedium 4.8
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-30853 · Other software · kovidgoyal · reported by GitHubMedium 5
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-27824 · Other software · kovidgoyal · reported by GitHubMedium 5.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-27810 · Other software · kovidgoyal · reported by GitHubMedium 6.4
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disposition` query parameter in the `/get/` and `/data-files/get/` endpoints. All users running the calibre Content Server with authentication enabled are affected. The vulnerability is exploitable by any authenticated user and can also be triggered by tricking an authenticated victim into clicking a crafted link. Version 9.4.0 contains a fix for the issue.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-26065 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting existing files. This can lead to potential code execution and Denial of Service through file corruption. This issue has been fixed in version 9.3.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.CVE-2026-26064 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks startswith('Pictures'), and does not sanitize '..' sequences. calibre's own ZipFile.extractall() in utils/zipfile.py does sanitize '..' via _get_targetpath(), but extract_pictures() bypasses this by using manual zf.read() + open(). This issue has been fixed in version 9.3.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026calibre is an e-book manager.CVE-2026-25731 · Other software · kovidgoyal · reported by GitHubHigh 7.8
calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026calibre is an e-book manager.CVE-2026-25636 · Other software · kovidgoyal · reported by GitHubHigh 8.2
calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem path and opens it in read-write mode, even when it points outside the conversion extraction directory. This vulnerability is fixed in 9.2.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026calibre is an e-book manager.CVE-2026-25635 · Other software · kovidgoyal · reported by GitHubHigh 8.6
calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. This vulnerability is fixed in 9.2.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user cCVE-2025-65858 · Other software · Janeczku · reported by MITRELow 3.5
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
- Product
- Calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025calibre is an e-book manager.CVE-2025-64486 · Other software · kovidgoyal · reported by GitHubCritical 9.3
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
- Product
- calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database.CVE-2025-55165 · Other software · gelbphoenix · reported by GitHubHigh 8.2
Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
- Product
- autocaliweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command InjCVE-2025-7404 · Other software · Calibre Web · reported by help@fluidattacks.comMedium 5.9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
- Product
- Calibre Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 24, 2025ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service CVE-2025-6998 · Other software · Calibre Web · reported by help@fluidattacks.comHigh 8.7
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
- Product
- Calibre Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Nov 15, 2024A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`.CVE-2021-3988 · Other software · janeczku · reported by security@huntr.devMedium 6.1
A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024An improper access control vulnerability exists in janeczku/calibre-web.CVE-2021-3987 · Other software · janeczku · reported by security@huntr.devMedium 4.3
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This issue can lead to unauthorized actions being performed by users.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users.CVE-2021-3986 · Other software · janeczku · reported by security@huntr.devMedium 4.3
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.CVE-2024-7009 · Other software · Calibre · reported by info@starlabs.sgMedium 4.2
Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.CVE-2024-7008 · Other software · Calibre · reported by info@starlabs.sgMedium 5.4
Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.CVE-2024-6782 · Other software · Calibre · reported by info@starlabs.sgCritical 9.8
Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.CVE-2024-6781 · Other software · Calibre · reported by info@starlabs.sgHigh 7.5
Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by tCVE-2024-39123 · Other software · janeczku · reported by MITREMedium 5.4
In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.
- Product
- calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.CVE-2023-46303 · Other software · Calibre-ebook · reported by MITREHigh 7.5
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.CVE-2023-2106 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.CVE-2022-2525 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2022Calibre-Web before 0.6.18 allows user table SQL Injection.CVE-2022-30765 · Other software · Janeczku · reported by MITRECritical 9.8
Calibre-Web before 0.6.18 allows user table SQL Injection.
- Product
- Calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.CVE-2022-0990 · Other software · janeczku · reported by security@huntr.devCritical 9.1
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.CVE-2022-0939 · Other software · janeczku · reported by security@huntr.devCritical 9.9
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2022Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-0406 · Other software · janeczku · reported by security@huntr.devMedium 4.3
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2022Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-0405 · Other software · janeczku · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-0767 · Other software · janeczku · reported by security@huntr.devCritical 9.9
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-0766 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2022Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-0339 · Other software · janeczku · reported by security@huntr.devCritical 9.8
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2022Improper Access Control in Pypi calibreweb prior to 0.6.16.CVE-2022-0273 · Other software · janeczku · reported by security@huntr.devMedium 6.5
Improper Access Control in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.CVE-2022-0352 · Other software · janeczku · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4164 · Other software · janeczku · reported by security@huntr.devHigh 8.8
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022calibre-web is vulnerable to Business Logic ErrorsCVE-2021-4171 · Other software · janeczku · reported by security@huntr.devCritical 9.8
calibre-web is vulnerable to Business Logic Errors
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2022calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4170 · Other software · janeczku · reported by security@huntr.devMedium 5.4
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- janeczku/calibre-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/converCVE-2021-44686 · Other software · Calibre-ebook · reported by MITREHigh 7.5
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Nov 16, 2021In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF).CVE-2021-25965 · Other software · calibreweb · reported by vulnerabilitylab@mend.ioHigh 8.8
In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.
- Product
- calibreweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 26, 2021Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.CVE-2011-4126 · Other software · Calibre-ebook · reported by Red HatHigh 8.1
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgit.zx2c4.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.