kovidgoyal vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202621

Newest CVEs

• CVE-2026-73249

  calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

  kovidgoyal · calibre

  High7.5
• CVE-2026-73248

  calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

  kovidgoyal · calibre

  High8.5
• CVE-2026-72913

  Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

  kovidgoyal · kitty

  High7.3
• CVE-2026-53511

  calibre: Arbitrary Code Execution in Template Formatter via Book Metadata

  kovidgoyal · calibre

  High8.5
• CVE-2026-54057

  Kitty vulnerable to command injection via unsanitized OSC 21 query reply

  kovidgoyal · kitty

  High7.3
• CVE-2026-54056

  Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging

  kovidgoyal · kitty

  High7.6
• CVE-2026-54055

  Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

  kovidgoyal · kitty

  Medium5.0
• CVE-2026-42851

  @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

  kovidgoyal · kitty

  High7.8
• CVE-2026-42850

  Kitty has a shell command injection

  kovidgoyal · kitty

  High7.4
• CVE-2026-33642

  Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

  kovidgoyal · kitty

  Critical9.9