Approved changes feed: RSS · Atom
cpe:2.3:a:kareadita:kavita:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kareadita (f4eb825b-3f7d-538c-8b89-ff6cc318c5c9) |
|---|---|
| Product | Kavita (1f1c241c-8350-5853-9dc3-c1fa5c955967) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47202 |
vulnerable | 2026-06-08 08:05:12.187299 |
Kavita: Pre-Auth Account Takeover
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0.9.0.2.
Published: 2026-05-26T17:30:55.961Z
Updated: 2026-05-27T17:23:39.941Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44776 |
vulnerable | 2026-06-08 08:05:11.309464 |
Kavita: IDOR in /api/Download/*
Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can download the full file contents, query file sizes, and read metadata for that content. This affects /api/Download/volume-size, /api/Download/chapter-size, /api/Download/series-size, /api/Download/volume, /api/Download/chapter, /api/Download/series, and /api/Chapter. This vulnerability is fixed in 0.9.0.
Published: 2026-05-26T17:29:40.897Z
Updated: 2026-05-26T18:27:30.186Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44775 |
vulnerable | 2026-06-08 08:05:11.309227 |
Kavita: No authentication at /api/Reader/image
Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Since entity IDs are sequential integers, an unauthenticated attacker can trivially enumerate all content on the server. This vulnerability is fixed in 0.9.0.
Published: 2026-05-26T17:27:11.008Z
Updated: 2026-05-27T13:53:07.589Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39307 |
vulnerable | 2026-06-08 06:41:49.034206 |
Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita
LOW (3.5)
Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1.
Published: 2024-06-28T20:44:53.930Z
Updated: 2024-08-02T04:19:20.747Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.