KDE vulnerabilities
Published CVEs affecting KDE products: 15 record(s), with severity, exploitation and fixes.
KDEConnect 2Dolphin 2Kcoreaddons 1Krita 1KDE Connect verification-code protocol 1KDE Connect information-exchange protocol 1KDE Connect protocol 1Messagelib 1Plasma-login-manager 1Skanpage 1Kdenlive 1Kleopatra 1Arianna 1
CVE-2026-110236
High · 7.0
CWE-78 Oct 13, 2026
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting in slotDoubleClickViewBackground, executing commands when victims double-click the view background.
CVE-2026-25710
High · 7.0
CWE-250 May 13, 2026
Execution with Unnecessary Privileges in KDE Plasma-login-manager
The new upstream added a privileged D-Bus
helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the system.
CVE-2026-45184
Medium · 6.5
CWE-829 May 9, 2026
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled…
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
CVE-2026-41526
High · 7.8
CWE-150 Apr 28, 2026
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments…
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
CVE-2026-41525
Medium · 6.5
CWE-669 Apr 28, 2026
Incorrect Resource Transfer Between Spheres in KDE Dolphin
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. (By default, Dolphin will then prompt the user to determine if they want to launch a script or executable; however, the intended behavior is to block the attempted action, not present a consent prompt.)
CVE-2026-42095
Medium · 4.0
CWE-306 Apr 24, 2026
Missing Authentication for Critical Function in KDE Arianna
bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
CVE-2026-41527
Medium · 6.9
CWE-670 Apr 21, 2026
Always-Incorrect Control Flow Implementation in KDE Kleopatra
KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring that only one instance is running.
CVE-2025-69412
Low · 3.4
CWE-295 Dec 31, 2025
Improper Certificate Validation in KDE Messagelib
KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.
CVE-2025-66270
Medium · 4.7
CWE-290 Dec 5, 2025
Authentication Bypass by Spoofing in KDE KDE Connect protocol
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
CVE-2025-32900
Medium · 4.3
CWE-348 Dec 5, 2025
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be…
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
CVE-2025-32901
Medium · 4.3
CWE-1287 Dec 5, 2025
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP)…
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
CVE-2025-32899
Medium · 4.3
CWE-1250 Dec 5, 2025
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired…
In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.
CVE-2025-32898
Medium · 4.7
CWE-331 Dec 5, 2025
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and…
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
CVE-2025-59820
Medium · 6.7
CWE-1284 Nov 26, 2025
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based…
In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport). Control flow proceeds even when a number of pixels becomes negative.
CVE-2025-55174
Low · 3.2
CWE-684 Nov 26, 2025
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents…
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly.