Kde Dolphin vulnerabilities

2 CVEs affecting Kde Dolphin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110236, published 2026-10-13.

More from Kde.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-110236, published 2026-10-13. High severity, CVSS 7.0. EPSS: 1% chance of exploitation in the next 30 days. KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder.…
• CVE-2026-41525, published 2026-04-28. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of…