PatchTheCVE: xfcehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-45062: In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability inhttps://patchthecve.com/cve/CVE-2022-45062.htmlhttps://patchthecve.com/cve/CVE-2022-45062.htmlWed, 17 Jun 2026 05:09:16 +0000CRITICAL 9.8: In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.CVE-2022-32278: XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attackhttps://patchthecve.com/cve/CVE-2022-32278.htmlhttps://patchthecve.com/cve/CVE-2022-32278.htmlWed, 17 Jun 2026 04:47:03 +0000HIGH 8.8: XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.CVE-2021-32563: An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2https://patchthecve.com/cve/CVE-2021-32563.htmlhttps://patchthecve.com/cve/CVE-2021-32563.htmlWed, 17 Jun 2026 03:53:10 +0000CRITICAL 9.8: An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.