Matthias Gerstner of SUSE

Local File Deletion Attack Vector in rm_rf() in seunshare

Process Kill Attack Vector in killall() in seunshare

portprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager

Caching of Authentication allows Authentication Bypass between users in qSnapper

Caching of Authentication allows Authentication Bypass in qSnapper

Information leak via “diff” methods in qSnapper

path traversal via `config` parameter in qSnapper

Weak polkit authentication check in qSnapper

malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API

The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the system.