# Kde vulnerabilities Source: https://junglewise.ai/threats/vendors/kde Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/kde.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in Kde: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110236, was published on 13 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 9 (0 critical, 0 exploited in the wild) ## About Kde Community-driven project that develops free and open-source desktop environments and applications for Linux and other Unix-like systems. ## Latest Kde vulnerabilities - [CVE-2026-110236: KDE Dolphin command injection via double-click custom action](https://junglewise.ai/threats/cve-2026-110236-kde-dolphin-24-08-0-through-26-08-2-contains-an-os-command) (high, CVSS 7, published 13 Oct 2026) - [CVE-2026-25710: KDE plasma-login-manager privilege escalation in plasmaloginauthhelper](https://junglewise.ai/threats/cve-2026-25710-kde-plasma-login-manager-privilege-escalation-in) (info, CVSS 7, published 13 May 2026) - [CVE-2026-45184: KDE Kdenlive remote code execution via malicious project file](https://junglewise.ai/threats/cve-2026-45184-kde-kdenlive-remote-code-execution-via-malicious-project-file) (medium, CVSS 6.5, published 9 May 2026) - [CVE-2026-41526: In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to…](https://junglewise.ai/threats/cve-2026-41526-in-kde-kcoreaddons-before-6-25-kshell-quoteargs-is-intended-to) (medium, CVSS 6.5, published 28 Apr 2026) - [CVE-2026-41525: KDE Dolphin sandbox escape via FileManager1 protocol](https://junglewise.ai/threats/cve-2026-41525-kde-dolphin-sandbox-escape-via-filemanager1-protocol) (medium, CVSS 6.5, published 28 Apr 2026) - [CVE-1999-1096: Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental…](https://junglewise.ai/threats/cve-1999-1096-buffer-overflow-in-kscreensaver-in-kde-klock-allows-local-users-to) (high, CVSS 7.2, published 16 May 1998) - [CVE-1999-1106: KDE kppp buffer overflow in account_name argument](https://junglewise.ai/threats/cve-1999-1106-kde-kppp-buffer-overflow-in-account-name-argument) (high, CVSS 7.2, published 29 Apr 1998) - [CVE-1999-1269: KDE Beta 3 arbitrary file overwrite via symlink in screen saver](https://junglewise.ai/threats/cve-1999-1269-kde-beta-3-arbitrary-file-overwrite-via-symlink-in-screen-saver) (low, CVSS 2.1, published 6 Feb 1998) - [CVE-1999-1267: KDE kfm arbitrary file modification via insecure TCP server](https://junglewise.ai/threats/cve-1999-1267-kde-kfm-arbitrary-file-modification-via-insecure-tcp-server) (medium, CVSS 5, published 5 May 1997) ## Most severe Kde vulnerabilities - [CVE-1999-1096: Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental…](https://junglewise.ai/threats/cve-1999-1096-buffer-overflow-in-kscreensaver-in-kde-klock-allows-local-users-to) (high, CVSS 7.2, published 16 May 1998) - [CVE-1999-1106: KDE kppp buffer overflow in account_name argument](https://junglewise.ai/threats/cve-1999-1106-kde-kppp-buffer-overflow-in-account-name-argument) (high, CVSS 7.2, published 29 Apr 1998) - [CVE-2026-110236: KDE Dolphin command injection via double-click custom action](https://junglewise.ai/threats/cve-2026-110236-kde-dolphin-24-08-0-through-26-08-2-contains-an-os-command) (high, CVSS 7, published 13 Oct 2026) - [CVE-2026-41526: In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to…](https://junglewise.ai/threats/cve-2026-41526-in-kde-kcoreaddons-before-6-25-kshell-quoteargs-is-intended-to) (medium, CVSS 6.5, published 28 Apr 2026) - [CVE-2026-45184: KDE Kdenlive remote code execution via malicious project file](https://junglewise.ai/threats/cve-2026-45184-kde-kdenlive-remote-code-execution-via-malicious-project-file) (medium, CVSS 6.5, published 9 May 2026) - [CVE-2026-41525: KDE Dolphin sandbox escape via FileManager1 protocol](https://junglewise.ai/threats/cve-2026-41525-kde-dolphin-sandbox-escape-via-filemanager1-protocol) (medium, CVSS 6.5, published 28 Apr 2026) - [CVE-1999-1267: KDE kfm arbitrary file modification via insecure TCP server](https://junglewise.ai/threats/cve-1999-1267-kde-kfm-arbitrary-file-modification-via-insecure-tcp-server) (medium, CVSS 5, published 5 May 1997) - [CVE-1999-1269: KDE Beta 3 arbitrary file overwrite via symlink in screen saver](https://junglewise.ai/threats/cve-1999-1269-kde-beta-3-arbitrary-file-overwrite-via-symlink-in-screen-saver) (low, CVSS 2.1, published 6 Feb 1998) - [CVE-2026-25710: KDE plasma-login-manager privilege escalation in plasmaloginauthhelper](https://junglewise.ai/threats/cve-2026-25710-kde-plasma-login-manager-privilege-escalation-in) (info, CVSS 7, published 13 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Kde technologies - [Kde](https://junglewise.ai/threats/technologies/kde): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Kde vulnerabilities", https://junglewise.ai/threats/vendors/kde, 13 November 2026.