Kde vulnerabilities

Products

• Kde 66
• Konqueror 34
• Kmail 11
• Sc 10
• Koffice 9
• Kdelibs 8
• Kpdf 8
• Ark 7
• Plasma-workspace 7
• Kdegraphics 6
• K-mail 5
• Kde-workspace 4
• Konqueror Embedded 4
• Kauth 3
• Applications 3
• Kdeconnect 3
• Kword 3
• Messagelib 3
• Dolphin 2
• Kio-extras 2
• Kmplayer 2
• Ktexteditor 2
• Kvt 2
• Okular 2
• Paste Applet 2
• Trojita 2

Newest

• kde dolphin KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name CVE-2026-110236 7.1 HighOctober 13, 2026
• kde plasma-login-manager The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from... CVE-2026-25710 7.0 HighMay 13, 2026
• kde kdenlive Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project... CVE-2026-45184 Fix available 6.5 MediumMay 9, 2026
• kde kcoreaddons In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that... CVE-2026-41526 Fix available 6.5 MediumApril 28, 2026
• kde dolphin KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to... CVE-2026-41525 Fix available 6.5 MediumApril 28, 2026
• kde arianna bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection... CVE-2026-42095 Fix available 4.0 MediumApril 24, 2026
• kde kleopatra KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a... CVE-2026-41527 6.9 MediumApril 21, 2026
• kde messagelib KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe... CVE-2025-69412 Fix available 3.4 LowDecember 31, 2025
• kde kdeconnect In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could... CVE-2025-32901 4.3 MediumDecember 5, 2025
• kde connect information-exchange protocol In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to... CVE-2025-32900 Fix available 4.3 MediumDecember 5, 2025
• kde kdeconnect In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices... CVE-2025-32899 4.3 MediumDecember 5, 2025
• kde connect verification-code protocol The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore... CVE-2025-32898 Fix available 4.7 MediumDecember 5, 2025
• kde connect protocol The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets.... CVE-2025-66270 Fix available 4.7 MediumNovember 26, 2025
• kde skanpage In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the... CVE-2025-55174 Fix available 3.2 LowNovember 26, 2025
• kde krita In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer... CVE-2025-59820 Fix available 6.7 MediumSeptember 25, 2025
• kde konsole KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports... CVE-2025-49091 Public exploitFix available 8.2 HighJune 11, 2025
• kde ark libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive. CVE-2024-57966 Fix available 5.0 MediumFebruary 3, 2025
• kde kmail ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of... CVE-2024-50624 Fix available 5.9 MediumOctober 27, 2024
• kde plasma-workspace KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1... CVE-2024-36041 Fix available 7.8 HighJune 3, 2024
• kde libksieve In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server... CVE-2023-52723 Fix available 7.1 HighApril 29, 2024
• kde plasma workspace, plasma-workspace +1 more KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal CVE-2024-1433 3.1 LowFebruary 11, 2024
• kde kcron KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename... CVE-2022-24986 Fix available 7.8 HighFebruary 26, 2022
• kde kate, ktexteditor +1 more The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91... CVE-2022-23853 Fix available 7.8 HighFebruary 11, 2022
• bandisoft ark, ark library +1 more bandisoft ARK library integer overflow vulnerability CVE-2021-26615 7.8 HighNovember 26, 2021
• bandisoft ark, ark library +1 more bandisoft ARK library heap overflow vulnerability CVE-2021-26603 8.6 HighSeptember 9, 2021
• kde kmail In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext... CVE-2021-38373 Fix available 5.3 MediumAugust 10, 2021
• kde trojita In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses... CVE-2021-38372 3.7 LowAugust 10, 2021
• kde kimageformats KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat:... CVE-2021-36083 Fix available 5.5 MediumJuly 1, 2021
• kde messagelib KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations.... CVE-2021-31855 Fix available 6.5 MediumMay 7, 2021
• kde discover libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically... CVE-2021-28117 Fix available 7.5 HighMarch 18, 2021
• kde partition manager An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand... CVE-2020-27187 Fix available 7.8 HighOctober 26, 2020
• kde kdeconnect, opensuse backports sle, leap +2 more In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send... CVE-2020-26164 Fix available 5.5 MediumOctober 7, 2020
• kde ark, canonical ubuntu linux, debian linux +2 more +4 more In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the... CVE-2020-24654 Fix available 3.3 LowAugust 29, 2020
• kde ark, canonical ubuntu linux, debian linux +2 more +4 more In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the... CVE-2020-16116 Fix available 3.3 LowJuly 31, 2020
• kde kmail, debian linux +1 more KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI... CVE-2020-15954 Fix available 6.5 MediumJuly 27, 2020
• kde amarok A remote user can create a specially crafted M3U file, media playlist file that when loaded by... CVE-2020-13152 Public exploit 5.5 MediumMay 20, 2020
• kde kio-extras fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a... CVE-2020-12755 Fix available 3.3 LowMay 9, 2020
• kde kmail An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) ... CVE-2020-11880 Fix available 6.5 MediumApril 17, 2020
• kde okular, debian linux, fedoraproject fedora +2 more KDE Okular before 1.10.0 allows code execution via an action link in a PDF document. CVE-2020-9359 Fix available 5.3 MediumMarch 18, 2020
• kde paste applet The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C... CVE-2013-2213 5.5 MediumFebruary 11, 2020
• kde paste applet The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in... CVE-2013-2120 Fix available 8.4 HighFebruary 11, 2020
• kde, kde konqueror, redhat enterprise linux +3 more +5 more The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to... CVE-2012-4512 Public exploitFix available EPSS 11.7% 8.8 HighFebruary 8, 2020
• kde kconfig, canonical ubuntu linux, debian linux +5 more +7 more In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to... CVE-2019-14744 Fix available 7.8 HighAugust 7, 2019
• kde kmail, debian linux +1 more In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as... CVE-2019-10732 Fix available 4.3 MediumApril 7, 2019
• kde kauth, fedoraproject fedora, opensuse backports +1 more +3 more KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as... CVE-2019-7443 Fix available 8.1 HighFebruary 26, 2019
• kde applications messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0... CVE-2018-19516 Fix available 5.3 MediumDecember 3, 2018
• kde applications The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger... CVE-2018-19120 Fix available 7.5 HighNovember 29, 2018
• kde okular, debian linux +1 more okular version 18.08 and earlier contains a Directory Traversal vulnerability in function ... CVE-2018-1000801 Fix available 5.5 MediumSeptember 6, 2018
• 9folders nine, apple mail, bloop airmail +14 more +16 more The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can... CVE-2017-17689 Fix available 5.9 MediumMay 16, 2018
• debian linux, kde plasma, opensuse leap +2 more kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary... CVE-2018-10380 Fix available 7.8 HighMay 8, 2018
• Show olderLoading…