CVE-2026-33206

< 9.6.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a pat

6.3MEDIUM

CVE-2026-33205

< 9.6.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Ser

5.5MEDIUM

CVE-2026-30853

< 9.5.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traver

5.0MEDIUM

CVE-2026-27824

< 9.4.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the c

5.3MEDIUM

CVE-2026-27810

< 9.4.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HT

6.4MEDIUM

CVE-2026-26065

< 9.3.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are

8.8HIGH

CVE-2026-26064

< 9.3.0

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below cont

8.8HIGH

CVE-2026-25731

< 9.2.0

calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templati

7.8HIGH

CVE-2026-25636

< 9.2.0

calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious

8.2HIGH

CVE-2026-25635

< 9.2.0

calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary f

8.6HIGH

CVE-2024-7009

<= 7.15.0

Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on

4.2MEDIUM

CVE-2024-7008

<= 7.15.0

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

5.4MEDIUM

CVE-2024-6781

<= 7.14.0

Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.

7.5HIGH

CVE-2023-46303

< 6.19.0

link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of t

7.5HIGH

CVE-2021-44686

< 5.32.0

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_pre

7.5HIGH

CVE-2011-4126

all versions

Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any d

8.1HIGH

CVE-2011-4125

all versions

A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to

9.8CRITICAL

CVE-2011-4124

all versions

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation o

9.8CRITICAL

CVE-2018-7889

all versions

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to exec

7.8HIGH

CVE-2016-10187

<= 2.74.0

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.

5.5MEDIUM