CVE-2025-49091

KDE Konsole (before version 25.04.2) is vulnerable to remote code execution via its URL-handling feature. If Konsole loads URLs from scheme handlers (e.g., ssh://, telnet://, rlogin://) and the corresponding binary is unavailable, it can fall back to invoking /bin/bash with the URL arguments, all...

CVE-2025-49091

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code...

CVE-2025-49091

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code...

CVE-2025-49091

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code...

PT-2025-24908 · Kde +4 · Konsole +4

Name of the Vulnerable Software and Affected Versions: konsole versions prior to 25.04.2 konsole versions 4:20.12.3 and earlier konsole versions 4:22.12.3 and earlier Description: The vulnerability in KDE Konsole allows remote code execution when loading URLs from scheme handlers such as ssh://,...

CVE-2023-28581

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2002-2333

Buffer overflow in konqueror in KDE 2.1 through 3.0 and 3.0.2 allows remote attackers to cause a denial of service crash via an IMG tag with large width and height attributes...

CVE-1999-0735

KDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories...

CVE-1999-0731

The KDE klock program allows local users to unlock a session using malformed input...

CVE-2025-43929

openactions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document e.g., a document opened in KDE ghostwriter...

Linux Distros Unpatched Vulnerability : CVE-2022-23853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The LSP Language Server Protocol plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening ...

Linux Distros Unpatched Vulnerability : CVE-2020-24654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a...

Linux Distros Unpatched Vulnerability : CVE-2021-38373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless Server requires authentication is checked...

Linux Distros Unpatched Vulnerability : CVE-2022-24986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the...

Linux Distros Unpatched Vulnerability : CVE-2023-52648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: Unmap the surface before resetting it on a plane state Switch to a new plane state requires unreferencing of all held surfaces. In the work required...

Linux Distros Unpatched Vulnerability : CVE-2013-2120

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The %password... macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma- addons does not properly generate passwords, which allows...

Linux Distros Unpatched Vulnerability : CVE-2017-9604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs...

Linux Distros Unpatched Vulnerability : CVE-2020-15954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE KMail 19.12.3 aka 5.13.3 engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use. CVE-2020-15954 Note that...

Linux Distros Unpatched Vulnerability : CVE-2014-8878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE KMail does not encrypt attachments in emails when automatic encryption is enabled, which allows remote attackers to obtain sensitive information by sniffing...