KDE vulnerabilities
We track 8 vulnerabilities in KDE products across 9 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest KDE vulnerabilities
- 7.0 High severity
Dolphin: Improper Neutralization of Special Elements used in an OS Command
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters
- 7.0 High severity
plasma-login-manager: Execution with Unnecessary Privileges
The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the system.
- 7.8 High severity
KCoreAddons: Improper Neutralization of Escape, Meta, or Control Sequences
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this
- 8.2 High severity
Konsole: Always-Incorrect Control Flow Implementation
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is ava
- 7.8 High severity
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before…
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the s
- 7.1 High severity
libksieve: Use of Hard-coded Credentials
In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
- 7.8 High severity
Kcron: Concurrent Execution using Shared Resource with Improper Synchronization
KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run una
- 7.8 High severity
Kate: Uncontrolled Search Path Element
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server