KDE

Products

Exploited and recent CVEs

• CVE-2026-110236 High 7.0 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name 1.0%
• CVE-2026-25710 High 7.0 The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the sys 0.1%
• CVE-2026-45184 Medium 6.5 Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used. 0.1%
• CVE-2026-41526 Medium 6.5 In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading t 0.2%
• CVE-2026-41525 Medium 6.5 KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of t 0.1%
• CVE-2026-42095 Medium 4.0 bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL. 0.2%
• CVE-2026-41527 Medium 6.9 KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance 0.1%
• CVE-2025-69412 Low 3.4 KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is 0.2%
• CVE-2025-32899 Medium 4.3 In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP. 0.2%
• CVE-2025-32900 Medium 4.3 In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects 0.1%
• CVE-2025-66270 Medium 4.7 The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.3 0.2%
• CVE-2025-32898 Medium 4.7 The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.0 0.2%
• CVE-2025-32901 Medium 4.3 In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash. 0.2%
• CVE-2025-59820 Medium 6.7 In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a nu 0.2%
• CVE-2025-55174 Low 3.2 In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of 0.2%
• CVE-2025-49091 High 8.2 KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed re 0.7%
• CVE-2024-57966 Medium 5.0 libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive. 0.3%
• CVE-2024-1433 Low 3.1 KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal 0.8%