Advisories · Technology
readest.
Every CVE that names readest among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
- readest
- Broken access control
- CVSS 6.5 Medium
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
- readest
- Path traversal
- CVSS 9.3 CriticalCritical · CVSS 9+
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
- readest
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
- readest
- Path traversal
- CVSS 8.8 High
Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
- readest
- Cross-site scripting (XSS)