https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:50:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-52600 EUVD-2026-52600 https://cve.radiocsirt.org/vuln/euvd-2026-52600 https://cve.radiocsirt.org/vuln/fkie_cve-2019-9153 <p>Improper Verification of a Cryptographic Signature in OpenPGP.js &lt;=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a &#34;standalone&#34; or &#34;timestamp&#34; signature.</p> <p>Improper Verification of a Cryptographic Signature in OpenPGP.js &lt;=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a &#34;standalone&#34; or &#34;timestamp&#34; signature.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-9153 https://cve.radiocsirt.org/vuln/ghsa-qwqc-28w3-fww6 <p><strong>Affected:</strong> npm: openpgp</p> <p>Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.</p> <p>## Recommendation</p> <p>Upgrade to version 4.2.0 or later. If you are upgrading from a version &lt;4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0</p> <p><strong>Affected:</strong> npm: openpgp</p> <p>Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.</p> <p>## Recommendation</p> <p>Upgrade to version 4.2.0 or later. If you are upgrading from a version &lt;4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0</p> https://cve.radiocsirt.org/vuln/ghsa-qwqc-28w3-fww6 https://cve.radiocsirt.org/vuln/gsd-2019-9153 gsd-2019-9153 https://cve.radiocsirt.org/vuln/gsd-2019-9153