CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 13/03/2026 |
| CVE-2026-27824 | 中5.3 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly | 27/02/2026 |
| CVE-2026-27810 | 中6.4 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerability in the calibre Content Server allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized `content_disp | 27/02/2026 |
| CVE-2026-26065 | 高8.8 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the use | 20/02/2026 |
| CVE-2026-26064 | 高8.8 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Star | 20/02/2026 |
| CVE-2026-25731 | 高7.8 | calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vul | 06/02/2026 |
| CVE-2026-25636 | 高7.8 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from META-INF/encryption.xml to an absolute filesystem | 06/02/2026 |
| CVE-2026-25635 | 高8.6 | calibre is an e-book manager. Prior to 9.2.0, Calibre's CHM reader contains a path traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows (haven't tested on other OS's), this can lead to Remote Code Execution by writing a payload to the Startup folder, which execut | 06/02/2026 |
| CVE-2024-7009 | 高7.1 | Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. | 06/08/2024 |
| CVE-2024-7008 | 中6.1 | Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. | 06/08/2024 |
| CVE-2024-6781 | 高7.5 | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. | 06/08/2024 |
| CVE-2023-46303 | 高7.5 | link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. | 22/10/2023 |
| CVE-2021-44686 | 高7.5 | calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py. | 07/12/2021 |
| CVE-2018-7889 | 高7.8 | gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call. | 08/03/2018 |
| CVE-2016-10187 | 中5.5 | The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript. | 16/03/2017 |