KO
Vendor
kovidgoyal
25
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73249 | CA calibre kovidgoyal | 7.5 | Aug 11 | calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification |
| CVE-2026-73248 | CA calibre kovidgoyal | 8.5 | Aug 11 | calibre: Bypass of Python template restrictions via nested `template()` leading to RCE |
| CVE-2026-72913 | KI kitty kovidgoyal | 7.3 | Aug 10 | Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences |
| CVE-2026-53511 | CA calibre kovidgoyal | 8.5 | Jul 7 | calibre: Arbitrary Code Execution in Template Formatter via Book Metadata |
| CVE-2026-54057 | KI kitty kovidgoyal | 7.8 | Jun 12 | Kitty vulnerable to command injection via unsanitized OSC 21 query reply |
| CVE-2026-54056 | KI kitty kovidgoyal | 7.1 | Jun 12 | Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging |
| CVE-2026-54055 | KI kitty kovidgoyal | 5.0 | Jun 12 | Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol |
| CVE-2026-42851 | KI kitty kovidgoyal | 7.8 | Jun 12 | @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE |
| CVE-2026-42850 | KI kitty kovidgoyal | 8.8 | Jun 12 | Kitty has a shell command injection |
| CVE-2026-33642 | KI kitty kovidgoyal | 9.8 | May 19 | Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check |
| CVE-2026-33633 | KI kitty kovidgoyal | 8.8 | May 19 | Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler |
| CVE-2026-33206 | CA calibre kovidgoyal | 6.3 | Mar 27 | calibre has a path traversal vulnerability |
| CVE-2026-33205 | CA calibre kovidgoyal | 5.5 | Mar 27 | calibre has Server-Side Request Forgery in ebook viewer backend |
| CVE-2026-30853 | CA calibre kovidgoyal | 8.2 | Mar 13 | calibre has a Path Traversal Leading to Arbitrary File Write |
| CVE-2026-27824 | CA calibre kovidgoyal | 5.3 | Feb 27 | calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing |
| CVE-2026-27810 | CA calibre kovidgoyal | 6.4 | Feb 27 | calibre Vulnerable to HTTP Response Header Injection |
| CVE-2026-26065 | CA calibre kovidgoyal | 8.8 | Feb 20 | calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution |
| CVE-2026-26064 | CA calibre kovidgoyal | 8.8 | Feb 20 | calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution |
| CVE-2026-25731 | CA calibre kovidgoyal | 7.8 | Feb 6 | Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export |
| CVE-2026-25635 | CA calibre kovidgoyal | 8.6 | Feb 6 | calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution |
| CVE-2026-25636 | CA calibre kovidgoyal | 7.8 | Feb 6 | calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution |
| CVE-2025-64486 | CA calibre kovidgoyal | 9.3 | Nov 7 | calibre is vulnerable to arbitrary code execution when opening FB2 files |
| CVE-2025-43929 | KI Kitty Kovidgoyal | 7.8 | Apr 20 | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a… |
| CVE-2024-7009 | CA Calibre Kovidgoyal | 7.1 | Aug 6 | Calibre SQL Injection |
| CVE-2020-35605 | KI Kitty Kovidgoyal | 9.8 | Dec 21 | The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be… |