15 results · Feed
-
Critical 9.8
CVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An att…
-
Low 3.6
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted arc…
-
Low 2.9CVE-2026-57062 Public exploit
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM becau…
-
High 7.8
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leadi…
-
Low 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid ba…
-
Low 3.3
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatur…
-
Unscored —
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyri…
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
-
Unscored —
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwis…
-
Unscored —
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a…
-
Unscored —
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes …
-
Unscored —
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in A…
-
Unscored —
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which all…
-
Unscored —
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify ke…
-
Unscored —
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent …