CVE-2021-28117

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

• https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356Patch
• https://github.com/KDE/discover/releasesThird Party Advisory
• https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60Patch, Third Party Advisory
• https://kde.org/info/security/advisory-20210310-1.txtPatch, Vendor Advisory
• https://userbase.kde.org/DiscoverProduct, Vendor Advisory
• https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356Patch
• https://github.com/KDE/discover/releasesThird Party Advisory
• https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60Patch, Third Party Advisory
• https://kde.org/info/security/advisory-20210310-1.txtPatch, Vendor Advisory
• https://userbase.kde.org/DiscoverProduct, Vendor Advisory

Published

Mar 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28111Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Crede…8.8
• CVE-2021-28112Draeger X-Dock Firmware before 03.00.13 has Active Debug Cod…8.8
• CVE-2021-28113A command injection vulnerability in the cookieDomain and re…6.7
• CVE-2021-28114Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a na…5.4
• CVE-2021-28115The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS v…6.1
• CVE-2021-28116Squid through 4.14 and 5.x through 5.0.5, in some configurat…5.3
• CVE-2021-28119Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote…9.8
• CVE-2021-28121Virtual Robots.txt before 1.10 does not block HTML tags in t…9.8
• CVE-2021-28122A request-validation issue was discovered in Open5GS 2.1.3 t…9.8
• CVE-2021-28123Undocumented Default Cryptographic Key Vulnerability in Cohe…9.8
• CVE-2021-28124A man-in-the-middle vulnerability in Cohesity DataPlatform s…5.9
• CVE-2021-28125Apache Superset up to and including 1.0.1 allowed for the cr…6.1