Vendor

    Kovidgoyal

    24 known vulnerabilities in products by Kovidgoyal, 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Kovidgoyal
    CriticalCVE-2020-35605

    Kovidgoyal Kitty: Code Execution

    also in 1 other product

    		9.8
    CriticalCVE-2026-26064

    calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution

    also in 2 other products

    		8.8
    CriticalCVE-2026-26065

    calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution

    also in 2 other products

    		8.8
    HighCVE-2026-25635

    calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution

    also in 2 other products

    		8.6
    HighCVE-2026-73249

    Kovidgoyal Calibre: Missing Authorization

    		7.5
    CriticalCVE-2026-33642

    Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

    also in 1 other product

    		9.9
    HighCVE-2026-42850

    Kitty has a shell command injection

    also in 2 other products

    		8.8
    HighCVE-2026-73248

    calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

    		—
    HighCVE-2026-53511

    calibre: Arbitrary Code Execution in Template Formatter via Book Metadata

    also in 1 other product

    		—
    HighCVE-2026-33633

    Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler

    also in 1 other product

    		7.5
    HighCVE-2026-72913

    Kovidgoyal Kitty: Improper Neutralization of Escape, Meta, or Control Sequences

    		—
    CriticalCVE-2025-64486

    calibre is vulnerable to arbitrary code execution when opening FB2 files

    also in 1 other product

    		—
    HighCVE-2026-54057

    Kitty vulnerable to command injection via unsanitized OSC 21 query reply

    also in 2 other products

    		7.8
    HighCVE-2026-42851

    @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

    also in 2 other products

    		7.8
    HighCVE-2026-33206

    calibre has a path traversal vulnerability

    also in 2 other products

    		6.3
    HighCVE-2026-54056

    Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging

    		7.1
    HighCVE-2026-25636

    calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution

    also in 2 other products

    		8.2
    HighCVE-2026-25731

    Kovidgoyal Calibre: Improper Neutralization of Special Elements Used in a Template Engine

    also in 1 other product

    		7.8
    MediumCVE-2026-27810

    calibre Vulnerable to HTTP Response Header Injection

    also in 2 other products

    		6.4
    MediumCVE-2026-54055

    Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

    also in 2 other products

    		5.0
    MediumCVE-2026-33205

    calibre has Server-Side Request Forgery in ebook viewer backend

    also in 2 other products

    		5.5
    MediumCVE-2026-27824

    calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

    also in 2 other products

    		5.3
    HighCVE-2026-30853

    calibre has a Path Traversal Leading to Arbitrary File Write

    also in 2 other products

    		5.0
    HighCVE-2025-43929

    Kitty: Origin Validation Error

    		4.1

    News

    Products

    Products by Kovidgoyal
    Calibre140
    Kovidgoyal Kitty100