KDE_Vuln

Thoughts on KDE vFAT vuln. 1: The scope isn't as large as I first imagined. Most systems are probably updated to newer versions of KDE or are running a different GUI. I'd have to look at some actual statistics to get a proper number though. Getting physical access to a machine is already a job in...

[SECURITY] Fedora 45 Update: plasma-nm-6.7.5-3.fc45

Plasma applet and editor for managing your network connections in KDE 4 using the default NetworkManager service...

Astra Linux – Vulnerability in ktexteditor, Kate

The LSP Language Server Protocol plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 attempts to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will attempt to run the LSP server binary in the directory of the...

Linux Distros Unpatched Vulnerability : CVE-2026-110236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names...

DEBIAN-CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

UBUNTU-CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110236: Improper Neutralization of Special Elements used in an OS Command

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

[SECURITY] Fedora 45 Update: kf6-kio-6.30.0-2.fc45

KDE Frameworks 6 Tier 3 solution for filesystem abstraction...

[SECURITY] Fedora 45 Update: kdelibs3-3.5.10-138.fc45

Libraries for KDE 3: KDE Libraries included: kdecore KDE core library, kdeui user interface, kfm file manager, khtmlw HTML widget, kio Input/Output, networking, kspell spelling checker, jscript javascript, kab addressbook, kimgio image manipulation...

CLEANSTART-2024-HZ44036 In KDE Ark before 20

Security vulnerability affects the ark package. In KDE Ark before 20...

[SECURITY] Fedora 45 Update: kf6-kfilemetadata-6.30.0-2.fc45

A Tier 2 KDE Framework for extracting file metadata...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kf5-kconfig (UTSA-2026-093173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093173 advisory. In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to...

OPENSUSE-SU-2026:21425-1 Security update for PackageKit

This update for PackageKit fixes the following issues: Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non security issue fixed: - KDE Discover ignores package locks bsc1263252...

CVE-2026-42095

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL...

Linux Distros Unpatched Vulnerability : CVE-2026-41525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional...

Fedora 44 : emacs (2026-ea9adf4496)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ea9adf4496 advisory. Recent KDEs default to Wayland, so Suggest PGTK build there. ---- libpixbufloader-xpm.so no-longer required with recent Glycin. Tenable has extracted the...

CVE-2026-41525

A flaw was found in KDE Dolphin. This vulnerability allows applications operating within a Flatpak or AppArmor sandbox to bypass security restrictions. By exploiting the FileManager1 protocol, a malicious application can prompt users to open files, including scripts or executables, located outsid...