KKovid Goyal

Products

Exploited and recent CVEs

• CVE-2026-95835 Medium 5.6 Missing ownership check on the shared memory object named by the kitty askpass escape code 0.1%
• CVE-2026-95834 Medium 4.6 Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer 0.1%
• CVE-2026-80432 Medium 6.0 Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop 0.1%
• CVE-2026-80431 Medium 6.8 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process 0.1%
• CVE-2026-80430 Medium 4.6 Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory 0.2%
• CVE-2026-95832 Critical 9.3 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell 0.2%