GN
Product
GnuPG
38
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 2High 9Medium 10Low 3
Watch
Add GnuPG to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-34903 | 6.5 | Jul 1 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met,… Affected: through 2.3.6 |
| CVE-2015-0837 | 5.9 | Nov 29 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a… Affected: before 1.4.19 |
| CVE-2026-24883 | 5.5 | Jan 27 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application… Affected: 2.5.3 before 2.5.17 |
| CVE-2015-1607 | 5.5 | Nov 20 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a… Affected: before 1.4.19; 2.0 before 2.0.27; 2.1.0 before 2.1.2 |
| CVE-2015-1606 | 5.5 | Nov 20 | The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a… Affected: before 2.1.2 |
| CVE-2011-2207 | 5.3 | Nov 27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate Affected: before 2.1.0 |
| CVE-2016-6313 | 5.3 | Dec 13 | The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to… Affected: through 1.4.14 |
| CVE-2025-68972 | 4.7 | Dec 27 | In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed… Affected: through 2.4.8 |
| CVE-2025-30258 | 4.7 | Mar 19 | In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the… Affected: before 2.4.8; 2.5.0 before 2.5.5 |
| CVE-2014-3591 | 4.2 | Nov 29 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's… Affected: before 1.4.19 |
Showing 10