CVE-2025-32898

The record

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Affected packages

Related vulnerabilities

• CVE-2026-80171 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-331
• CVE-2026-62646 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-331
• CVE-2026-4936 IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through… CWE-331
• CVE-2026-4937 IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and… CWE-331
• CVE-2026-19906 A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. CWE-331
• CVE-2026-19748 A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7… CWE-331
• CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-331
• CVE-2026-38447 osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. CWE-331