Vendor
KDE
19 known vulnerabilities.
KDE at a glance
- Last 12 months
- 15
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 2
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 0 |
| Apr 2026 | 4 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 6 | 0 |
| Nov 2025 | 2 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 1 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
19 results · Feed
-
High 7.0
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters…
-
High 7.0
The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.…
-
Medium 6.5
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
-
Medium 6.5
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a…
-
Medium 6.5
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of t…
-
Medium 4.0
bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
-
Medium 6.9
KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there …
-
Low 3.4
KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka ph…
-
Medium 4.7
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect…
-
Medium 4.3
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically…
-
Medium 4.3
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
-
Medium 4.3
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the d…
-
Medium 4.7
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force at…
-
Low 3.2
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginnin…
-
Medium 6.7
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impe…
-
High 8.2CVE-2025-49091 Public exploit
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme…
-
Medium 5.0
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
-
Low 3.1
KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. Th…
-
Unscored —
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service…