CVE-2026-73249 | High | 7.5 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/sr… |
CVE-2026-73248 | | | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar fi… |
CVE-2026-72913 | | | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the… |
CVE-2026-53511 | | | 2026-07-07 | calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, inclu… |
CVE-2026-54057 | High | 7.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, inclu… |
CVE-2026-54056 | High | 7.6 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or tru… |
CVE-2026-54055 | Medium | 5.0 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission proto… |
CVE-2026-42851 | High | 7.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded… |
CVE-2026-42850 | High | 8.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special… |
CVE-2026-33642 | Critical | 9.9 | 2026-05-19 | Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validatio… |
CVE-2026-33633 | High | 7.5 | 2026-05-19 | Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can w… |
CVE-2026-33206 | Medium | 6.3 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exi… |
CVE-2026-33205 | Medium | 5.5 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vuln… |
CVE-2026-30853 | Medium | 5.0 | 2026-03-13 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the Rock… |
CVE-2026-27824 | Medium | 5.3 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute… |
CVE-2026-27810 | Medium | 6.4 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection… |
CVE-2026-26065 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal… |
CVE-2026-26064 | High | 8.8 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerab… |
CVE-2026-25731 | High | 7.8 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary co… |
CVE-2026-25636 | High | 8.2 | 2026-02-06 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitra… |
CVE-2026-25635 | High | 8.6 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user… |
CVE-2025-64486 | | | 2025-11-08 | calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker… |
CVE-2025-43929 | Medium | 4.1 | 2025-04-20 | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted do… |
CVE-2020-35605 | Critical | 9.8 | 2020-12-21 | The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special char… |