Kde Messagelib vulnerabilities

3 CVEs affecting Kde Messagelib, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-69412, published 2026-01-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-9604, published 2017-06-13. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature,…
CVE-2021-31855, published 2021-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server)…
CVE-2025-69412, published 2026-01-01. Low severity, CVSS 3.4. EPSS: 0.2% chance of exploitation in the next 30 days. KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is…