kovidgoyal

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

kovidgoyal records in CISA KEV

No kovidgoyal vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Kitty 9 records HIGH

Records

30 records

TI-2026-26023 CVE-2026-33642

Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

HIGH 82

Kitty is a cross-platform GPU based terminal.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.00286 Published 2026-05-19 Fixed in 0.47.0 CWE-125

TI-2026-51129 CVE-2026-72913

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

HIGH 73

Kitty is a cross-platform GPU based terminal.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00207 Published 2026-08-10 Partial fix · 0.48.2 CWE-150

TI-2026-26014 CVE-2026-33633

Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler

HIGH 73

Kitty is a cross-platform GPU based terminal.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00377 Published 2026-05-19 Fixed in 0.47.0 CWE-122

TI-2026-51386 CVE-2026-73249

Missing authorization in kovidgoyal calibre

HIGH 72

calibre is an e-book manager.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00436 Published 2026-08-11 Fixed in 9.12.0 CWE-862

TI-2026-51385 CVE-2026-73248

calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

HIGH 72

calibre is an e-book manager.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00197 Published 2026-08-11 Fixed in 9.12.0 CWE-94

TI-2026-38585 CVE-2026-53511

calibre: Arbitrary Code Execution in Template Formatter via Book Metadata

HIGH 72

calibre is an e-book manager.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.0022 Published 2026-07-07 Fixed in 9.10.0 CWE-94

TI-2026-25627 CVE-2026-33206

calibre has a path traversal vulnerability

HIGH 69

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 4.0HIGH 8.2 Local No auth User interaction EPSS 0.00216 Published 2026-03-27 Fixed in 9.6.0 CWE-23

TI-2026-23682 CVE-2026-30853

calibre has a Path Traversal Leading to Arbitrary File Write

HIGH 69

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.0019 Published 2026-03-13 Fixed in 9.5.0 CWE-22

TI-2026-20799 CVE-2026-25731

Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export

HIGH 69

calibre is an e-book manager.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00276 Published 2026-02-06 Fixed in 9.2.0 CWE-1336

TI-2026-38991 CVE-2026-54057

Kitty vulnerable to command injection via unsanitized OSC 21 query reply

HIGH 67

Kitty is a cross-platform GPU based terminal.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00172 Published 2026-06-12 Fixed in 0.47.3 CWE-150

TI-2025-28495 CVE-2025-43929 · GHSA-cch3-2vm3-v73j

Origin validation error in kitty

HIGH 67

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00192 Published 2025-04-20 Fixed in 0.41.0 CWE-346

TI-2026-38990 CVE-2026-54056

Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging

HIGH 66

Kitty is a cross-platform GPU based terminal.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00268 Published 2026-06-12 Fixed in 0.47.2 CWE-59

TI-2026-22163 CVE-2026-27810

calibre Vulnerable to HTTP Response Header Injection

MEDIUM 62

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00242 Published 2026-02-27 Fixed in 9.4.0 CWE-113

TI-2026-22176 CVE-2026-27824

calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

MEDIUM 57

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00174 Published 2026-02-27 Fixed in 9.4.0 CWE-307

TI-2026-38989 CVE-2026-54055

Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

MEDIUM 56

Kitty is a cross-platform GPU based terminal.

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.00072 Published 2026-06-12 Fixed in 0.47.2 CWE-367

TI-2020-18102 CVE-2020-35605 · GHSA-6fm5-8wjh-r65x

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote…

MEDIUM 49

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03764 Published 2020-12-21 No fix listed

TI-2026-21068 CVE-2026-26064

calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution

MEDIUM 44

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 4.0CRITICAL 9.3 Local No auth User interaction EPSS 0.00979 Published 2026-02-20 Fixed in 9.3.0 CWE-22

TI-2026-21069 CVE-2026-26065

calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution

MEDIUM 43

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books.

CVSS 4.0CRITICAL 9.3 Local No auth User interaction EPSS 0.0059 Published 2026-02-20 Fixed in 9.3.0 CWE-22

TI-2026-63703 CVE-2026-95832 · GHSA-hvwf-v5fx-xvj6

Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell

MEDIUM 41

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arb…

CVSS 4.0CRITICAL 9.3 Local No auth User interaction EPSS 0.0016 Published 2026-09-25 Fixed in 0.49.0 CWE-74

TI-2025-39878 CVE-2025-64486

calibre is vulnerable to arbitrary code execution when opening FB2 files

MEDIUM 41

calibre is an e-book manager.

CVSS 4.0CRITICAL 9.3 Local No auth User interaction EPSS 0.00191 Published 2025-11-07 Fixed in 8.14.0 CWE-73

TI-2026-20735 CVE-2026-25635

calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution

MEDIUM 40

calibre is an e-book manager.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00502 Published 2026-02-06 Fixed in 9.2.0 CWE-22

TI-2026-31059 CVE-2026-42851

@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

LOW 35

Kitty is a cross-platform GPU based terminal.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00164 Published 2026-06-12 Fixed in 0.47.0 CWE-862

TI-2026-20736 CVE-2026-25636

calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution

LOW 35

calibre is an e-book manager.

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.00231 Published 2026-02-06 Fixed in 9.2.0 CWE-22

TI-2026-31058 CVE-2026-42850

Kitty has a shell command injection

LOW 34

Kitty is a cross-platform GPU based terminal.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00287 Published 2026-06-12 Fixed in 0.47.0 CWE-77

TI-2026-55508 CVE-2026-80431 · GHSA-fx7r-q727-j825

Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

LOW 29

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_…

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00134 Published 2026-09-25 Fixed in 0.49.0 CWE-787

Open these records in search →

Critical	6
High	15
Medium	9
Low	0
No CVSS	0