Rreadest

Products

Exploited and recent CVEs

• CVE-2026-57562 Medium 6.5 Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller 0.4%
• CVE-2026-57565 Medium 6.5 Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal) 1.0%
• CVE-2026-57566 Critical 9.3 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy 0.6%
• CVE-2026-57567 High 8.6 Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview 0.7%
• CVE-2026-82642 High 8.8 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution 0.7%