CVE-2026-73248

A flaw was found in calibre, an e-book manager. A remote attacker could craft a malicious e-book file such as EPUB, OPF, or PDF containing specially crafted metadata. When a user opens or imports this file, the application's processing of nested templates can bypass Python template restrictions,...

CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0...

CVE-2025-48950 MaxKB Python Sandbox Bypass in Function Library

MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as /bin,/usr/bin, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directori...