KDE vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20241
3. 202510
4. 20267

Newest CVEs

• CVE-2026-110236

  KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

  KDE · Dolphin

  High7.1
• CVE-2026-25710

  The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service…

  KDE · plasma-login-manager

  High7.0
• CVE-2026-45184

  Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

  KDE · Kdenlive

  Medium6.5
• CVE-2026-41526

  In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not…

  KDE · KCoreAddons

  Medium6.5
• CVE-2026-41525

  KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without…

  KDE · Dolphin

  Medium6.5
• CVE-2026-42095

  bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.

  KDE · Arianna

  Medium4.0
• CVE-2026-41527

  KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism…

  KDE · Kleopatra

  Medium6.9
• CVE-2025-69412

  KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing…

  KDE · messagelib

  Low3.4
• CVE-2025-66270

  The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect…

  KDE · KDE Connect protocol

  Medium4.7
• CVE-2025-32901

  In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.

  KDE · KDEConnect

  Medium4.3