What’s Vulnerable › Vulnerabilities

CVE-2025-69412

• Severity: low (CVSS 3.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-01 · updated 2026-06-17
• Weakness: CWE-295

Description

KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.

Affected products

• KDE messagelib: before 25.11.90 — fixed in 25.11.90

How to fix

Upgrade to a fixed version: KDE messagelib 25.11.90. Check the vendor advisory for mitigations.

References

• https://developers.google.com/safe-browsing/v4
• https://developers.google.com/safe-browsing/v4/lookup-api
• https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3
• https://github.com/KDE/messagelib/compare/v25.11.80...v25.11.90

Get alerted when CVE-2025-69412 or the next vulnerability affects your stack