Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Readwise Clear all filters
TI-2026-15063 CVE-2026-18311 · GHSA-p2jj-7m4x-3gfh

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2026-09-25 No fix listed CWE-79
TI-2026-15069 CVE-2026-18320 · GHSA-v29r-35gc-f5pr

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2026-09-25 Fixed in 8.10.1 CWE-79
TI-2026-15064 CVE-2026-18312 · GHSA-fjx6-m8r4-w94f

Cross-site scripting in Readwise Reader

Priority LOW 27

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00254 Published 2026-09-25 No fix listed CWE-79