Skip to content
Noroxi

GnuPG records

55 published records for vendor gnupg.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
92.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

55 records
  • CVE-2026-24881
    40Plan

    In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffe

    CriticalCVSS 9.8No exploitEPSS 1%

    gnupg · gnupgJan 27, 2026

  • CVE-2022-3515
    40Plan

    A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser.

    CriticalCVSS 9.8No exploitEPSS 1%

    gnupg · libksbaJan 12, 2023

  • CVE-2022-47629
    40Plan

    Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

    CriticalCVSS 9.8No exploitEPSS 1%

    gnupg · libksbaDec 20, 2022

  • CVE-2008-1530
    38Monitor

    GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted dup

    CriticalCVSS 9.3No exploitEPSS 4%

    gnupg · gnupgMar 27, 2008

  • CVE-2018-1000858
    35Monitor

    GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CS

    HighCVSS 8.8No exploitEPSS 1%

    gnupg · gnupgDec 20, 2018

  • CVE-2010-2547
    34Monitor

    Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service

    HighCVSS 8.1No exploitEPSS 5%

    gnupg · gnupgAug 5, 2010

  • CVE-2018-12020
    32Monitor

    mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers

    HighCVSS 7.5No exploitEPSS 8%

    gnupg · gnupgJun 8, 2018

  • CVE-2014-9087
    32Monitor

    Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of se

    HighCVSS 7.5No exploitEPSS 5%

    gnupg · libksbaDec 1, 2014

  • CVE-2017-0379
    31Monitor

    Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret

    HighCVSS 7.5No exploitEPSS 3%

    gnupg · libgcryptAug 29, 2017

  • CVE-2016-4579
    31Monitor

    Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to

    HighCVSS 7.5No exploitEPSS 3%

    gnupg · libksbaJun 13, 2016

  • CVE-2016-4356
    31Monitor

    The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of

    HighCVSS 7.5No exploitEPSS 3%

    gnupg · libksbaJun 13, 2016

  • CVE-2016-4574
    31Monitor

    Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denia

    HighCVSS 7.5No exploitEPSS 2%

    gnupg · libksbaJun 13, 2016

  • CVE-2019-13050
    31Monitor

    Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a Gn

    HighCVSS 7.5No exploitEPSS 2%

    gnupg · gnupgJun 29, 2019

  • CVE-2021-33560
    31Monitor

    Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel att

    HighCVSS 7.5Proof of conceptEPSS 2%

    gnupg · libgcryptJun 8, 2021

  • CVE-2016-4355
    31Monitor

    Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted

    HighCVSS 7.5No exploitEPSS 2%

    gnupg · libksbaJun 13, 2016

  • CVE-2016-4353
    31Monitor

    ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of s

    HighCVSS 7.5No exploitEPSS 2%

    gnupg · libksbaJun 13, 2016

  • CVE-2018-9234
    31Monitor

    GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a

    HighCVSS 7.5No exploitEPSS 1%

    gnupg · gnupgApr 3, 2018

  • CVE-2016-4354
    31Monitor

    ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash

    HighCVSS 7.5No exploitEPSS 1%

    canonical · ubuntu linuxJun 13, 2016

  • CVE-2018-6829
    31Monitor

    cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers t

    HighCVSS 7.5No exploitEPSS 1%

    gnupg · libgcryptFeb 7, 2018

  • CVE-2020-25125
    31Monitor

    GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim i

    HighCVSS 7.8No exploitEPSS 1%

    gnupg · gnupgSep 3, 2020

  • CVE-2021-3345
    31Monitor

    _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets

    HighCVSS 7.8Proof of conceptEPSS 1%

    gnupg · libgcryptJan 29, 2021

  • CVE-2026-24882
    31Monitor

    In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and E

    HighCVSS 7.8No exploitEPSS 0%

    gnupg · gnupgJan 27, 2026

  • CVE-2019-14855
    30Monitor

    A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm.

    HighCVSS 7.5No exploitEPSS 1%

    gnupg · gnupgMar 20, 2020

  • CVE-2017-7526
    28Monitor

    libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left

    MediumCVSS 6.8No exploitEPSS 3%

    gnupg · libgcryptJul 26, 2018

  • CVE-2006-6169
    28Monitor

    Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might all

    MediumCVSS 6.8No exploitEPSS 3%

    gnupg · gnupgNov 29, 2006