https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:26:09.550754+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-52600 EUVD-2026-52600 2026-10-09T08:26:09.616144+00:00 EUVD-2026-52600 https://cve.radiocsirt.org/vuln/fkie_cve-2019-9153 fkie_cve-2019-9153 2026-10-09T08:26:09.616186+00:00

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

 https://cve.radiocsirt.org/vuln/ghsa-qwqc-28w3-fww6 GHSA-qwqc-28w3-fww6 — Message Signature Bypass in openpgp 2026-10-09T08:26:09.616221+00:00

Affected: npm: openpgp

Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.

## Recommendation

Upgrade to version 4.2.0 or later. If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0

 https://cve.radiocsirt.org/vuln/gsd-2019-9153 gsd-2019-9153 2026-10-09T08:26:09.616253+00:00 gsd-2019-9153