KDE

KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.

Multiple vulnerabilities within the KDE desktop environment components Dolphin and KShell allow an attacker to execute arbitrary code, compromising the integrity of affected Linux desktop systems.

A local attacker can exploit a vulnerability within the KDE desktop environment to execute arbitrary code with the privileges of the Session Manager.

A vulnerability in the KDE Konsole application allows a remote, unauthenticated attacker to execute arbitrary code, potentially leading to full system compromise.

Attackers may exploit SUID/SGID binaries like pkexec, su, or sudo on Linux systems to execute commands with elevated privileges, by identifying instances where a process runs with root privileges (user ID 0 or group ID 0) while the real user or group ID is non-root, allowing a low-privilege foothold to gain full system control.

Multiple vulnerabilities in KDE Kdenlive and Okular allow a remote, anonymous attacker to execute arbitrary code, bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.