Kde vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-110236	DO Dolphin KDE	7.0	1%	Oct 13	KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
CVE-2026-25710	PL plasma-login-manager KDE	7.0	0%	May 13	The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can…
CVE-2026-45184	KD Kdenlive KDE	6.5	0%	May 9	Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used
CVE-2026-41525	DO Dolphin KDE	6.5	0%	Apr 28	KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny
CVE-2026-41526	KC KCoreAddons KDE	7.8	0%	Apr 28	In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command
CVE-2026-42095	AR Arianna KDE	4.0	0%	Apr 24	bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL
CVE-2026-41527	KL Kleopatra KDE	6.9	0%	Apr 21	KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring…
CVE-2025-69412	ME messagelib KDE	3.4	0%	Dec 31	KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data
CVE-2024-36041	PL Plasma-workspace Kde	7.8	0%	Jul 5	KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections…
CVE-2024-1433	PL Plasma-workspace Kde	3.7	1%	Feb 11	A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0
CVE-2022-24986	KC Kcron Kde	7.8	0%	Feb 26	KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session
CVE-2022-23853	KA Kate Kde	7.8	1%	Feb 11	The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given…
CVE-2021-38373	KM Kmail Kde	5.3	1%	Aug 10	In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked
CVE-2021-38372	TR Trojita Kde	3.7	1%	Aug 10	In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS
CVE-2021-36083	KI Kimageformats Kde	5.5	1%	Jul 1	KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE
CVE-2021-31855	ME Messagelib Kde	6.5	1%	Jun 2	KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations
CVE-2021-28117	DI Discover Kde	7.5	2%	Mar 20	libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://)…
CVE-2020-27187	PM Partition Manager Kde	7.8	0%	Oct 26	An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0
CVE-2020-26164	KD Kdeconnect Kde	5.5	1%	Oct 7	In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network…
CVE-2020-24654	AR Ark Kde	3.3	1%	Sep 2	In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory
CVE-2020-16116	AR Ark Kde	3.3	2%	Aug 3	In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal
CVE-2020-15954	KM Kmail Kde	6.5	1%	Jul 27	KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use
CVE-2020-13152	AM Amarok Kde	5.5	4%	May 20	A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste…
CVE-2020-12755	KI Kio-extras Kde	3.3	0%	May 9	fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option
CVE-2020-11880	KM Kmail Kde	6.5	1%	Apr 17	An issue was discovered in KDE KMail before 19.12.3
CVE-2020-9359	OK Okular Kde	5.3	1%	Mar 24	KDE Okular before 1.10.0 allows code execution via an action link in a PDF document
CVE-2018-19516	KA Kde Applications Kde	5.3	1%	Mar 12	messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value
CVE-2013-2213	PA Paste Applet Kde	5.5	0%	Feb 11	The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for…
CVE-2013-2120	PA Paste Applet Kde	8.4	1%	Feb 11	The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent…
CVE-2012-4512	KD Kde Kde	8.8	12%	Feb 8	The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face…
CVE-2013-4133	KD Kde-workspace Kde	7.5	3%	Dec 10	kde-workspace before 4.10.5 has a memory leak in plasma desktop
CVE-2019-14744	KC Kconfig Kde	7.8	4%	Aug 7	In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction
CVE-2019-7443	KA Kauth Kde	8.1	2%	May 7	KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp
CVE-2019-10732	KM Kmail Kde	4.3	1%	Apr 7	In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email
CVE-2018-19120	KA Kde Applications Kde	7.5	1%	Nov 29	The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source…
CVE-2018-1000801	OK Okular Kde	5.5	2%	Sep 6	okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file…
CVE-2017-17689	KM Kmail Kde	5.9	4%	May 16	The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL
CVE-2018-10380	PL Plasma Kde	7.8	0%	May 8	kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack
CVE-2018-10361	KT Ktexteditor Kde	7.8	0%	Apr 25	An issue was discovered in KTextEditor 5.34.0 through 5.45.0
CVE-2018-6791	PL Plasma-workspace Kde	6.8	1%	Feb 7	An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0
CVE-2018-6790	PL Plasma-workspace Kde	5.3	2%	Feb 7	An issue was discovered in KDE Plasma Workspace before 5.12.0
CVE-2014-8878	KM Kmail Kde	5.9	1%	Sep 28	KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network
CVE-2015-7543	KD Kdelibs Kde	7.0	0%	Jul 25	aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory
CVE-2017-9604	ME Messagelib Kde	7.5	1%	Jun 13	KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the…
CVE-2017-8422	KA Kauth Kde	7.8	2%	May 17	KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app
CVE-2017-5330	AR Ark Kde	7.8	3%	Mar 27	ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications
CVE-2017-6410	KD Kdelibs Kde	5.5	1%	Mar 2	kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication…
CVE-2016-7968	KM Kmail Kde	6.5	1%	Dec 23	KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
CVE-2016-7967	KM Kmail Kde	8.1	2%	Dec 23	KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
CVE-2016-7966	KM Kmail Kde	7.3	2%	Dec 23	Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer
CVE-2016-7787	KD Kde-cli-tools Kde	4.9	2%	Dec 23	A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user
CVE-2016-2312	PL Plasma-workspace Kde	6.8	0%	Dec 23	Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again
CVE-2016-6232	KA Karchives Kde	7.5	4%	Aug 2	Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename…
CVE-2016-3100	KF Kde Frameworks Kde	8.4	0%	Jul 13	kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture…
CVE-2015-1308	PL Plasma-workspace Kde	–	1%	Jan 26	kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when…
CVE-2015-1307	PL Plasma-workspace Kde	–	1%	Jan 26	plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package
CVE-2013-7252	KA Kde Applications Kde	–	2%	Jan 18	kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to…
CVE-2014-8600	KD Kde-runtime Kde	–	2%	Dec 8	Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to…
CVE-2014-8651	PL Plasma-desktop Kde	–	0%	Dec 6	The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility…
CVE-2014-5033	KA Kauth Kde	–	0%	Aug 19	KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions…