https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-38373.htmlhttps://patchthecve.com/cve/CVE-2021-38373.htmlWed, 17 Jun 2026 04:01:58 +0000MEDIUM 5.3: In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.https://patchthecve.com/cve/CVE-2020-15954.htmlhttps://patchthecve.com/cve/CVE-2020-15954.htmlWed, 17 Jun 2026 02:57:29 +0000MEDIUM 6.5: KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.https://patchthecve.com/cve/CVE-2020-11880.htmlhttps://patchthecve.com/cve/CVE-2020-11880.htmlWed, 17 Jun 2026 02:50:58 +0000MEDIUM 6.5: An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bahttps://patchthecve.com/cve/CVE-2019-10732.htmlhttps://patchthecve.com/cve/CVE-2019-10732.htmlWed, 17 Jun 2026 02:11:34 +0000MEDIUM 4.3: In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the inthttps://patchthecve.com/cve/CVE-2014-8878.htmlhttps://patchthecve.com/cve/CVE-2014-8878.htmlWed, 17 Jun 2026 00:17:28 +0000MEDIUM 5.9: KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network.https://patchthecve.com/cve/CVE-2017-9604.htmlhttps://patchthecve.com/cve/CVE-2017-9604.htmlWed, 17 Jun 2026 01:28:33 +0000HIGH 7.5: KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.https://patchthecve.com/cve/CVE-2016-7968.htmlhttps://patchthecve.com/cve/CVE-2016-7968.htmlWed, 17 Jun 2026 00:53:51 +0000MEDIUM 6.5: KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.https://patchthecve.com/cve/CVE-2016-7967.htmlhttps://patchthecve.com/cve/CVE-2016-7967.htmlWed, 17 Jun 2026 00:53:51 +0000HIGH 8.1: KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.https://patchthecve.com/cve/CVE-2016-7966.htmlhttps://patchthecve.com/cve/CVE-2016-7966.htmlWed, 17 Jun 2026 00:53:51 +0000HIGH 7.3: Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Althttps://patchthecve.com/cve/CVE-2006-7062.htmlhttps://patchthecve.com/cve/CVE-2006-7062.htmlTue, 16 Jun 2026 22:34:18 +0000HIGH 7.8: calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message.https://patchthecve.com/cve/CVE-2006-2104.htmlhttps://patchthecve.com/cve/CVE-2006-2104.htmlTue, 16 Jun 2026 22:24:21 +0000MEDIUM 6.8: Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to compose.php, or (5) m, https://patchthecve.com/cve/CVE-2005-0404.htmlhttps://patchthecve.com/cve/CVE-2005-0404.htmlTue, 16 Jun 2026 22:11:02 +0000MEDIUM 5.0: KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed or encrypted, via HTML formatted email.