Product by Kovidgoyal
Calibre
14 known vulnerabilities in Calibre (Kovidgoyal), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-26064 | calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution | 8.8 | |
| Critical | CVE-2026-26065 | calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution | 8.8 | |
| High | CVE-2026-25635 | calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution | 8.6 | |
| High | CVE-2026-73249 | Kovidgoyal Calibre: Missing Authorization | 7.5 | |
| High | CVE-2026-73248 | calibre: Bypass of Python template restrictions via nested `template()` leading to RCE | — | |
| High | CVE-2026-53511 | calibre: Arbitrary Code Execution in Template Formatter via Book Metadata | — | |
| Critical | CVE-2025-64486 | calibre is vulnerable to arbitrary code execution when opening FB2 files | — | |
| High | CVE-2026-33206 | calibre has a path traversal vulnerability | 6.3 | |
| High | CVE-2026-25636 | calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution | 8.2 | |
| High | CVE-2026-25731 | Kovidgoyal Calibre: Improper Neutralization of Special Elements Used in a Template Engine | 7.8 | |
| Medium | CVE-2026-27810 | calibre Vulnerable to HTTP Response Header Injection | 6.4 | |
| Medium | CVE-2026-33205 | calibre has Server-Side Request Forgery in ebook viewer backend | 5.5 | |
| Medium | CVE-2026-27824 | calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing | 5.3 | |
| High | CVE-2026-30853 | calibre has a Path Traversal Leading to Arbitrary File Write | 5.0 |