EUVD-2025-201386

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49...

PT-2025-49221

Name of the Vulnerable Software and Affected Versions KDE Connect versions prior to 1.33.0 Valent versions prior to 1.0.0.alpha.47 GSConnect versions prior to 59 KDE Connect iOS versions prior to 0.5 KDE Connect desktop versions prior to 25.04 Description A crafted packet can alter the displayed...

CVE-2025-32900

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5...

CVE-2025-32901

In KDE Connect before 1.33.0 on Android, malicious device IDs sent via broadcast UDP could cause an application crash...

CVE-2025-32899

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP...

CVE-2025-32898

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 5...

CVE-2025-32899

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP...

CVE-2025-32901

In KDE Connect before 1.33.0 on Android, malicious device IDs sent via broadcast UDP could cause an application crash...

PT-2025-49308

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.49.0 Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. Versions from 0.47.0 up to 0.49.0 incorrectly create a Kubernetes Role. This role grants Apache Kafka Connect and...

CVE-2025-66270

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49...

KDE Connect security feature vulnerability

KDE Connect is a software from the KDE community that connects cell phones and computers. A Security Feature Issue vulnerability exists in versions of KDE Connect prior to 2025-04-18, which stems from a captcha protocol that uses only 8 characters, which could lead to brute-force breaking attacks...

KDE Connect security vulnerabilities

KDE Connect is a software from the KDE community that connects cell phones and computers. A security vulnerability exists in versions of KDE Connect prior to 1.33.0, which stems from a specially crafted data packet that could result in devices being unpaired...

KDE Connect security vulnerabilities

KDE Connect is a software from the KDE community that connects cell phones and computers. A security vulnerability exists in versions of KDE Connect prior to 1.33.0 that originates from a malicious device ID could cause the application to crash...

KDE Connect security vulnerabilities

KDE Connect is a software from the KDE community that connects cell phones and computers. A security vulnerability exists in versions of KDE Connect prior to 2025-11-28 that stems from an unassociated device ID and could affect KDE Connect clients on multiple platforms...

CVE-2025-32900: Use of Less Trusted Source

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5...

CVE-2025-32900

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5...

KDE Connect security vulnerabilities

KDE Connect is a software from the KDE community that connects cell phones and computers. A security vulnerability exists in versions of KDE Connect prior to 2025-04-18, which stems from the use of broadcast UDP for the message exchange protocol and could lead to temporary tampering of device...

DEBIAN-CVE-2025-66506

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.3, function identity.extractIssuerURL splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious...

CVE-2025-66506

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.3, function identity.extractIssuerURL splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious...

CVE-2025-66506 Fulcio allocates excessive memory during token parsing

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.3, function identity.extractIssuerURL splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious...