Threat Intelligence Database

CVE-2026-7709 is a medium severity vulnerability in janeczku Calibre-Web up to version 0.6.26. It involves improper authorization due to manipulation of the user_id argument in the generate_auth_token function within cps/kobo_auth.py. The vulnerability can be exploited remotely without user interaction. Although an exploit is publicly available, there is no vendor response or official patch as of the publication date.

CVE-2025-65858 is a stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 that allows attackers with user creation privileges to inject malicious JavaScript into the username field. This payload is stored unsanitized and executed when the /ajax/listusers endpoint is accessed, potentially leading to limited confidentiality and integrity impacts. The vulnerability requires authenticated access and user interaction to trigger. Although the CVSS score is low (3.5), the flaw could be leveraged in targeted attacks within environments using Calibre-Web. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using Calibre-Web should be aware of this vulnerability and implement mitigations to prevent exploitation. Countries with higher adoption of Calibre-Web or with strategic interest in digital libraries and document management may be more affected.

LowVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-65858

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-39123