Every CVE whose affected-product data names Calibre-ebook Calibre, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (20)
CVE-2011-4124 — CVSS 9.8 (critical): Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of…
CVE-2011-4125 — CVSS 9.8 (critical): A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute…
CVE-2026-26065 — CVSS 8.8 (high): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are…
CVE-2026-26064 — CVSS 8.8 (high): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a…
CVE-2026-25635 — CVSS 8.6 (high): calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file…
CVE-2026-25636 — CVSS 8.2 (high): calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB…
CVE-2011-4126 — CVSS 8.1 (high): Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to…
CVE-2026-25731 — CVSS 7.8 (high): calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine…
CVE-2018-7889 — CVSS 7.8 (high): gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute…
CVE-2021-44686 — CVSS 7.5 (high): calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in…
CVE-2023-46303 — CVSS 7.5 (high): link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the…
CVE-2024-6781 — CVSS 7.5 (high): Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
CVE-2026-27810 — CVSS 6.4 (medium): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP…
CVE-2026-33206 — CVSS 6.3 (medium): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path…
CVE-2026-33205 — CVSS 5.5 (medium): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side…
CVE-2016-10187 — CVSS 5.5 (medium): The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
CVE-2024-7008 — CVSS 5.4 (medium): Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
CVE-2026-27824 — CVSS 5.3 (medium): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre…
CVE-2026-30853 — CVSS 5.0 (medium): calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal…
CVE-2024-7009 — CVSS 4.2 (medium): Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the…