Astra Linux – Vulnerability in ktexteditor, Kate

The LSP Language Server Protocol plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 attempts to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will attempt to run the LSP server binary in the directory of the...

KDE_Vuln

Gedanken zur KDE-vFAT-Sicherheitslücke. 1: Der Umfang ist nicht so groß, wie ich zunächst angenommen habe. Die meisten Systeme sind vermutlich auf neuere Versionen von KDE aktualisiert oder verwenden eine andere GUI. Ich müsste mir jedoch einige tatsächliche Statistiken ansehen, um eine genaue Za...

[SECURITY] Fedora 45 Update: kf6-kio-6.30.0-2.fc45

KDE Frameworks 6 Tier 3 solution for filesystem abstraction...

[SECURITY] Fedora 45 Update: kdelibs3-3.5.10-138.fc45

Libraries for KDE 3: KDE Libraries included: kdecore KDE core library, kdeui user interface, kfm file manager, khtmlw HTML widget, kio Input/Output, networking, kspell spelling checker, jscript javascript, kab addressbook, kimgio image manipulation...

CLEANSTART-2024-HZ44036 In KDE Ark before 20

Security vulnerability affects the ark package. In KDE Ark before 20...

[SECURITY] Fedora 45 Update: kf6-kfilemetadata-6.30.0-2.fc45

A Tier 2 KDE Framework for extracting file metadata...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kf5-kconfig (UTSA-2026-093173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093173 advisory. In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to...

OPENSUSE-SU-2026:21425-1 Security update for PackageKit

This update for PackageKit fixes the following issues: Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non security issue fixed: - KDE Discover ignores package locks bsc1263252...

CVE-2026-42095

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL...

Fedora 44 : emacs (2026-ea9adf4496)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ea9adf4496 advisory. Recent KDEs default to Wayland, so Suggest PGTK build there. ---- libpixbufloader-xpm.so no-longer required with recent Glycin. Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-41525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional...

CVE-2026-41525

A flaw was found in KDE Dolphin. This vulnerability allows applications operating within a Flatpak or AppArmor sandbox to bypass security restrictions. By exploiting the FileManager1 protocol, a malicious application can prompt users to open files, including scripts or executables, located outsid...

AZL-85232 CVE-2026-41526 affecting package kf-kcoreaddons for versions less than 5.249.0-2

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path t...

CVE-2026-41525

KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or...

UBUNTU-CVE-2026-41525

KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or...

SUSE CVE-2026-42095

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL...

CVE-2026-41525

KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or...

CVE-2026-41526: Improper Neutralization of Escape, Meta, or Control Sequences

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path t...

PT-2026-35678

Name of the Vulnerable Software and Affected Versions KDE KCoreAddons versions prior to 6.25 Description The KShell::quoteArgs function is designed to safely quote arguments for shell commands. However, it fails to adequately handle metacharacters, which can lead to a shell escape. Applications...

CVE-2026-41525: Incorrect Resource Transfer Between Spheres

KDE Dolphin before 25.12.3 allows applications in a Flatpak or with AppArmor confinement to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or...