Vendors / Kareadita Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 2
Exploited now Kareadita records in CISA KEV No Kareadita vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01204 · Published 2022-11-14 · Fixed in 0.6.0.3 CWE-307
Priority HIGH 77
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00613 · Published 2026-10-22 · Fixed in 0.5.4.1 CWE-22
Priority MEDIUM 60
Kavita is a cross platform reading server.
CVSS 4.0 MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.0025 · Published 2026-05-26 · Fixed in 0.9.0 CWE-639
Priority MEDIUM 57
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01047 · Published 2022-11-11 · Fixed in 0.6.0.3 CWE-307
Priority MEDIUM 47
Kavita is a cross platform reading server.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00171 · Published 2026-05-26 · Fixed in 0.9.0.2 CWE-287
Priority LOW 36
Kavita is a cross platform reading server.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00281 · Published 2026-05-26 · Fixed in 0.9.0 CWE-306
Priority LOW 36
Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00484 · Published 2023-02-19 · Fixed in 0.7.0 CWE-306
Priority LOW 35
Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.03472 · Published 2022-08-10 · Fixed in 0.5.4.1 CWE-918
Priority LOW 17
Kavita is a cross platform reading server.
CVSS 3.1 LOW 3.5· Network · Low privileges · User interaction · EPSS 0.00463 · Published 2024-06-28 · No fix listed CWE-79
Priority LOW 12
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects.
CVSS 4.0 LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00279 · Published 2026-10-13 · No fix listed CWE-918
Open these records in search → All records by CVSS severity
2 2 4 2 0
THREATIST.IORead the docs