Known vulnerabilities in Calibre

Vendor: Calibre
Software: Calibre
Software CPE: cpe:2.3:a:calibre:calibre:*:*:*:*:*:*:*:*
Total vulnerabilities: 25
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Calibre Calibre is affected by 25 known vulnerabilities: 10 high, 10 medium, 5 low Critical High Medium Low

Vulnerabilities (25)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146756 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
9.14.0 02.09.2026 SB2026090257
#VU146755 - Heap-based Buffer Overflow
CWE-122 Low
No
No
9.13.0 02.09.2026 SB2026090258
#VU146754 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
9.14.0 02.09.2026 SB2026090257
#VU146753 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
9.14.0 02.09.2026 SB2026090257
#VU146752 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
9.14.0 02.09.2026 SB2026090257
#VU146751 - External Control of File Name or Path
CWE-73 Medium
No
No
9.14.0 02.09.2026 SB2026090257
#VU140779 - Missing Authorization
CVE-2026-73249
CWE-862 Medium
No
No
9.12.0 03.08.2026 SB2026080337
#VU140778 - Eval Injection
CVE-2026-73248
CWE-95 High
No
No
9.12.0 03.08.2026 SB2026080337
#VU135816 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-53511
CWE-94 High
No
No
9.10.0 29.06.2026 SB20260629109
SB2026071301
SB2026071302
#VU135815 - Relative Path Traversal
CVE-2026-33206
CWE-23 Medium
No
No
9.6.0 29.06.2026 SB20260629108
SB20260629121
SB20260629122
#VU135814 - Server-Side Request Forgery (SSRF)
CVE-2026-33205
CWE-918 Low
No
No
9.6.0 29.06.2026 SB20260629108
SB20260629121
SB20260629122
#VU135813 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-30853
CWE-22 Medium
No
No
9.5.0 29.06.2026 SB20260629107
#VU135812 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-27810
CWE-113 Low
No
No
9.4.0 29.06.2026 SB20260629106
#VU135811 - Origin Validation Error
CVE-2026-27824
CWE-346 Medium
No
No
9.4.0 29.06.2026 SB20260629106
#VU135810 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-25636
CWE-22 High
No
No
9.2.0 29.06.2026 SB20260629105
#VU135809 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-25635
CWE-22 High
No
No
9.2.0 29.06.2026 SB20260629105
#VU135808 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-25731
CWE-1336 High
No
No
9.2.0 29.06.2026 SB20260629105
#VU123107 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-26065
CWE-22 High
Available
No
9.3.0 20.02.2026 SB2026022018
#VU123106 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-26064
CWE-22 High
Available
No
9.3.0 20.02.2026 SB2026022018
#VU118842 - Improper input validation
CVE-2025-64486
CWE-20 High
No
No
8.14.0 28.11.2025 SB2025112872
SB2025112879


Showing elements 1 - 20 out of 25