Login Request a demo
CA
Product
calibre
by kovidgoyal · last CVE Aug 11, 2026
14
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 1High 9Medium 4Low 0
Severity
All severities14Critical1High9Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add calibre to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-64486
9.3
0%
Nov 7
calibre is vulnerable to arbitrary code execution when opening FB2 files
Affected: < 8.14.0
CVE-2026-26065
8.8
1%
Feb 20
calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution
Affected: < 9.3.0
CVE-2026-26064
8.8
1%
Feb 20
calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution
Affected: < 9.3.0
CVE-2026-25635
8.6
1%
Feb 6
calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution
Affected: < 9.2.0
CVE-2026-73248
8.5
0%
Aug 11
calibre: Bypass of Python template restrictions via nested `template()` leading to RCE
Affected: < 9.12.0
CVE-2026-53511
8.5
0%
Jul 7
calibre: Arbitrary Code Execution in Template Formatter via Book Metadata
Affected: < 9.10.0
CVE-2026-30853
8.2
0%
Mar 13
calibre has a Path Traversal Leading to Arbitrary File Write
Affected: < 9.5.0
CVE-2026-25731
7.8
0%
Feb 6
Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export
Affected: < 9.2.0
CVE-2026-25636
7.8
0%
Feb 6
calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution
Affected: < 9.2.0
CVE-2026-73249
7.5
0%
Aug 11
calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
Affected: < 9.12.0
CVE-2026-27810
6.4
0%
Feb 27
calibre Vulnerable to HTTP Response Header Injection
Affected: < 9.4.0
CVE-2026-33206
6.3
0%
Mar 27
calibre has a path traversal vulnerability
Affected: < 9.6.0
CVE-2026-33205
5.5
0%
Mar 27
calibre has Server-Side Request Forgery in ebook viewer backend
Affected: < 9.6.0
CVE-2026-27824
5.3
0%
Feb 27
calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing
Affected: < 9.4.0
Showing 14