Vendor
KDE
19 known vulnerabilities.
Products
12 results · Clear filters · Feed
-
Medium 6.5
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
-
Medium 6.5
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a…
-
Medium 6.5
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of t…
-
Medium 4.0
bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
-
Medium 6.9
KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there …
-
Medium 4.7
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect…
-
Medium 4.3
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically…
-
Medium 4.3
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
-
Medium 4.3
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the d…
-
Medium 4.7
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force at…
-
Medium 6.7
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impe…
-
Medium 5.0
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.