Login Request a demo
KD
Vendor
Kde
66 products with CVEs on record
245
CVEs
0
On KEV
1
New 30D
Products
DO
Dolphin
KDE
7.0
2 CVEs0 on KEV1 new
KD
Kde
Kde
8.8
66 CVEs0 on KEV0 new
KO
Konqueror
Kde
–
33 CVEs0 on KEV0 new
KS
Kde SC
Kde
–
10 CVEs0 on KEV0 new
KM
Kmail
Kde
8.1
10 CVEs0 on KEV0 new
KO
Koffice
Kde
–
9 CVEs0 on KEV0 new
KD
Kdelibs
Kde
7.8
8 CVEs0 on KEV0 new
KP
Kpdf
Kde
–
8 CVEs0 on KEV0 new
PL
Plasma-workspace
Kde
7.8
7 CVEs0 on KEV0 new
KD
Kdegraphics
Kde
–
6 CVEs0 on KEV0 new
KM
K-mail
Kde
–
5 CVEs0 on KEV0 new
AR
Ark
Kde
7.8
4 CVEs0 on KEV0 new
KD
Kde-workspace
Kde
7.5
4 CVEs0 on KEV0 new
KE
Konqueror Embedded
Kde
–
4 CVEs0 on KEV0 new
KA
Kauth
Kde
8.1
3 CVEs0 on KEV0 new
KA
Kde Applications
Kde
7.5
3 CVEs0 on KEV0 new
KD
KDEConnect
KDE
5.5
3 CVEs0 on KEV0 new
KW
Kword
Kde
–
3 CVEs0 on KEV0 new
ME
messagelib
KDE
7.5
3 CVEs0 on KEV0 new
KI
Kio-extras
Kde
3.3
2 CVEs0 on KEV0 new
KM
Kmplayer
Kde
–
2 CVEs0 on KEV0 new
KT
Ktexteditor
Kde
7.8
2 CVEs0 on KEV0 new
KV
Kvt
Kde
–
2 CVEs0 on KEV0 new
OK
Okular
Kde
5.5
2 CVEs0 on KEV0 new
PA
Paste Applet
Kde
8.4
2 CVEs0 on KEV0 new
TR
Trojita
Kde
5.9
2 CVEs0 on KEV0 new
AM
Amarok
Kde
5.5
1 CVEs0 on KEV0 new
AR
Arianna
KDE
4.0
1 CVEs0 on KEV0 new
AR
Arts
Kde
7.8
1 CVEs0 on KEV0 new
DC
Dcopserver
Kde
–
1 CVEs0 on KEV0 new
DC
Desktop Communication Protocol Daemon
Kde
–
1 CVEs0 on KEV0 new
DI
Discover
Kde
7.5
1 CVEs0 on KEV0 new
KA
Karchives
Kde
7.5
1 CVEs0 on KEV0 new
KA
Kate
Kde
7.8
1 CVEs0 on KEV0 new
KC
Kcheckpass
Kde
–
1 CVEs0 on KEV0 new
KC
Kconfig
Kde
7.8
1 CVEs0 on KEV0 new
KC
KCoreAddons
KDE
7.8
1 CVEs0 on KEV0 new
KC
Kcron
Kde
7.8
1 CVEs0 on KEV0 new
KB
Kde Beta 3
Kde
–
1 CVEs0 on KEV0 new
KD
Kde-cli-tools
Kde
4.9
1 CVEs0 on KEV0 new
KC
KDE Connect information-exchange protocol
KDE
4.3
1 CVEs0 on KEV0 new
KC
KDE Connect protocol
KDE
4.7
1 CVEs0 on KEV0 new
KC
KDE Connect verification-code protocol
KDE
4.7
1 CVEs0 on KEV0 new
KF
Kde Frameworks
Kde
8.4
1 CVEs0 on KEV0 new
KP
Kde Pim
Kde
–
1 CVEs0 on KEV0 new
KD
Kde-runtime
Kde
–
1 CVEs0 on KEV0 new
KD
Kdebase
Kde
–
1 CVEs0 on KEV0 new
KD
Kdenlive
KDE
6.5
1 CVEs0 on KEV0 new
KD
Kdeutils
Kde
–
1 CVEs0 on KEV0 new
KG
Kget
Kde
–
1 CVEs0 on KEV0 new
KI
Kimageformats
Kde
5.5
1 CVEs0 on KEV0 new
KI
Kio
Kde
5.5
1 CVEs0 on KEV0 new
KL
Kleopatra
KDE
6.9
1 CVEs0 on KEV0 new
KL
Klisa
Kde
–
1 CVEs0 on KEV0 new
KO
Kopete
Kde
–
1 CVEs0 on KEV0 new
KR
Krita
KDE
6.7
1 CVEs0 on KEV0 new
KS
Kscreenlocker
Kde
6.8
1 CVEs0 on KEV0 new
KS
Ksirc
Kde
6.5
1 CVEs0 on KEV0 new
KT
Ktv
Kde
–
1 CVEs0 on KEV0 new
LI
Libkhtml
Kde
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-110236
DO
Dolphin
KDE
7.0
1%
Oct 13KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
CVE-2026-25710
PL
plasma-login-manager
KDE
7.0
0%
May 13The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can…
CVE-2026-45184
KD
Kdenlive
KDE
6.5
0%
May 9Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used
CVE-2026-41525
DO
Dolphin
KDE
6.5
0%
Apr 28KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny
CVE-2026-41526
KC
KCoreAddons
KDE
7.8
0%
Apr 28In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command
CVE-2026-42095
AR
Arianna
KDE
4.0
0%
Apr 24bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL
CVE-2026-41527
KL
Kleopatra
KDE
6.9
0%
Apr 21KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism (KUniqueService) for ensuring…
CVE-2025-69412
ME
messagelib
KDE
3.4
0%
Dec 31KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data
CVE-2025-32901
KD
KDEConnect
KDE
4.3
0%
Dec 5In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash
CVE-2025-32900
KC
KDE Connect information-exchange protocol
KDE
4.3
0%
Dec 5In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP…
CVE-2025-32898
KC
KDE Connect verification-code protocol
KDE
4.7
0%
Dec 5The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks
CVE-2025-32899
KD
KDEConnect
KDE
4.3
0%
Dec 5In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair
CVE-2025-66270
KC
KDE Connect protocol
KDE
4.7
0%
Dec 5The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets
CVE-2025-55174
SK
Skanpage
KDE
3.2
0%
Nov 26In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the…
CVE-2025-59820
KR
Krita
KDE
6.7
0%
Nov 26In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImport)
CVE-2024-36041
PL
Plasma-workspace
Kde
7.8
0%
Jul 5KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections…
CVE-2024-1433
PL
Plasma-workspace
Kde
3.7
1%
Feb 11A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0
CVE-2022-24986
KC
Kcron
Kde
7.8
0%
Feb 26KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session
CVE-2022-23853
KT
Ktexteditor
Kde
7.8
1%
Feb 11The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given…
CVE-2021-38373
KM
Kmail
Kde
5.3
1%
Aug 10In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked
CVE-2021-38372
TR
Trojita
Kde
3.7
1%
Aug 10In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS
CVE-2021-36083
KI
Kimageformats
Kde
5.5
1%
Jul 1KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE
CVE-2021-31855
ME
Messagelib
Kde
6.5
1%
Jun 2KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations
CVE-2021-28117
DI
Discover
Kde
7.5
2%
Mar 20libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://)…
CVE-2020-27187
PM
Partition Manager
Kde
7.8
0%
Oct 26An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0
CVE-2020-26164
KD
Kdeconnect
Kde
5.5
1%
Oct 7In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network…
CVE-2020-24654
AR
Ark
Kde
3.3
1%
Sep 2In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory
CVE-2020-16116
AR
Ark
Kde
3.3
2%
Aug 3In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal
CVE-2020-15954
KM
Kmail
Kde
6.5
1%
Jul 27KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use
CVE-2020-13152
AM
Amarok
Kde
5.5
4%
May 20A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste…
CVE-2020-12755
KI
Kio-extras
Kde
3.3
0%
May 9fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option
CVE-2020-11880
KM
Kmail
Kde
6.5
1%
Apr 17An issue was discovered in KDE KMail before 19.12.3
CVE-2020-9359
OK
Okular
Kde
5.3
1%
Mar 24KDE Okular before 1.10.0 allows code execution via an action link in a PDF document
CVE-2018-19516
KA
Kde Applications
Kde
5.3
1%
Mar 12messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value
CVE-2013-2213
PA
Paste Applet
Kde
5.5
0%
Feb 11The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for…
CVE-2013-2120
PA
Paste Applet
Kde
8.4
1%
Feb 11The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent…
CVE-2012-4512
KD
Kde
Kde
8.8
12%
Feb 8The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face…
CVE-2013-4133
KD
Kde-workspace
Kde
7.5
3%
Dec 10kde-workspace before 4.10.5 has a memory leak in plasma desktop
CVE-2019-14744
KC
Kconfig
Kde
7.8
4%
Aug 7In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction
CVE-2019-7443
KA
Kauth
Kde
8.1
2%
May 7KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp
CVE-2019-10732
KM
Kmail
Kde
4.3
1%
Apr 7In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email
CVE-2018-19120
KA
Kde Applications
Kde
7.5
1%
Nov 29The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source…
CVE-2018-1000801
OK
Okular
Kde
5.5
2%
Sep 6okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file…
CVE-2017-17689
KM
Kmail
Kde
5.9
4%
May 16The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL
CVE-2018-10380
PL
Plasma
Kde
7.8
0%
May 8kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack
CVE-2018-10361
KT
Ktexteditor
Kde
7.8
0%
Apr 25An issue was discovered in KTextEditor 5.34.0 through 5.45.0
CVE-2018-6791
PL
Plasma-workspace
Kde
6.8
1%
Feb 7An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0
CVE-2018-6790
PL
Plasma-workspace
Kde
5.3
2%
Feb 7An issue was discovered in KDE Plasma Workspace before 5.12.0
CVE-2014-8878
KM
Kmail
Kde
5.9
1%
Sep 28KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network
CVE-2015-7543
KD
Kdelibs
Kde
7.0
0%
Jul 25aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory
CVE-2017-9604
KM
Kmail
Kde
7.5
1%
Jun 13KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the…
CVE-2017-8422
KA
Kauth
Kde
7.8
2%
May 17KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app
CVE-2017-5330
AR
Ark
Kde
7.8
3%
Mar 27ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications
CVE-2017-6410
KD
Kdelibs
Kde
5.5
1%
Mar 2kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication…
CVE-2016-7968
KM
Kmail
Kde
6.5
1%
Dec 23KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
CVE-2016-7967
KM
Kmail
Kde
8.1
2%
Dec 23KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
CVE-2016-7966
KM
Kmail
Kde
7.3
2%
Dec 23Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer
CVE-2016-7787
KD
Kde-cli-tools
Kde
4.9
2%
Dec 23A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user
CVE-2016-2312
KS
Kscreenlocker
Kde
6.8
0%
Dec 23Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again
CVE-2016-6232
KA
Karchives
Kde
7.5
4%
Aug 2Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename…