Read the docs

Readwise

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Readwise records in CISA KEV

No Readwise vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-15069 CVE-2026-18320 · GHSA-v29r-35gc-f5pr

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2026-09-25 Fixed in 8.10.1 CWE-79
TI-2026-15064 CVE-2026-18312 · GHSA-fjx6-m8r4-w94f

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00254 Published 2026-09-25 No fix listed CWE-79
TI-2026-15063 CVE-2026-18311 · GHSA-p2jj-7m4x-3gfh

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2026-09-25 No fix listed CWE-79
Open these records in search →