[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ15L7pboROR1-6hlwcOy5_l08w0NvWqPtia_12V9r0A":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":51,"kevVulnerabilities":115,"topProductsByCves":116,"seoMetadata":124,"meta":133},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":50},12414,"gnupg",7,48,0,516,"2025-03-19","g",[16,20,26,32,37,42,46],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},50853,235,30,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},50856,"libgcrypt",111,15,"2021-09-06",{"id":27,"product_name":28,"version_count":29,"cve_count":30,"kev_count":11,"last_cve_update":31},50858,"libksba",52,9,"2023-01-12",{"id":33,"product_name":34,"version_count":35,"cve_count":36,"kev_count":11,"last_cve_update":31},50859,"vs-desktop",3,1,{"id":38,"product_name":39,"version_count":40,"cve_count":11,"kev_count":11,"last_cve_update":41},50855,"gpgme",71,null,{"id":43,"product_name":44,"version_count":45,"cve_count":11,"kev_count":11,"last_cve_update":41},50854,"gpgee",2,{"id":47,"product_name":48,"version_count":49,"cve_count":11,"kev_count":11,"last_cve_update":41},50857,"libgpg-error",42,"Gnupg is a technology vendor with 7 tracked products and 48 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[52,61,69,74,79,84,90,95,102,109],{"cveId":53,"description":54,"publishedDate":55,"cvssScore":56,"cvssVersion":57,"severity":58,"isKev":59,"epssScore":60},"CVE-2018-12020","mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","2018-06-08",7.5,"v3.1","High",false,0.08247,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":66,"severity":67,"isKev":59,"epssScore":68},"CVE-2006-3082","parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.","2006-06-19",5,"v2","Medium",0.07306,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":65,"cvssVersion":66,"severity":67,"isKev":59,"epssScore":73},"CVE-2006-3746","Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.","2006-07-28",0.07214,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":56,"cvssVersion":66,"severity":58,"isKev":59,"epssScore":78},"CVE-2014-9087","Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S\u002FMIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.","2014-12-01",0.05661,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":65,"cvssVersion":66,"severity":67,"isKev":59,"epssScore":83},"CVE-2007-1263","GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","2007-03-06",0.05528,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":88,"cvssVersion":57,"severity":58,"isKev":59,"epssScore":89},"CVE-2010-2547","Use-after-free vulnerability in kbx\u002Fkeybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","2010-08-05",8.1,0.05342,{"cveId":91,"description":92,"publishedDate":93,"cvssScore":65,"cvssVersion":66,"severity":67,"isKev":59,"epssScore":94},"CVE-2013-4402","The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","2013-10-28",0.0503,{"cveId":96,"description":97,"publishedDate":98,"cvssScore":99,"cvssVersion":66,"severity":100,"isKev":59,"epssScore":101},"CVE-2008-1530","GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers \"memory corruption around deduplication of user IDs.\"","2008-03-27",9.3,"Critical",0.04298,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":106,"cvssVersion":107,"severity":67,"isKev":59,"epssScore":108},"CVE-2017-7526","libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.","2018-07-26",6.8,"v3.0",0.03835,{"cveId":110,"description":111,"publishedDate":112,"cvssScore":113,"cvssVersion":107,"severity":67,"isKev":59,"epssScore":114},"CVE-2016-6313","The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.","2016-12-13",5.3,0.03597,[],[117,118,119,120,121,122,123],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},{"id":27,"product_name":28,"version_count":29,"cve_count":30,"kev_count":11,"last_cve_update":31},{"id":33,"product_name":34,"version_count":35,"cve_count":36,"kev_count":11,"last_cve_update":31},{"id":38,"product_name":39,"version_count":40,"cve_count":11,"kev_count":11,"last_cve_update":41},{"id":43,"product_name":44,"version_count":45,"cve_count":11,"kev_count":11,"last_cve_update":41},{"id":47,"product_name":48,"version_count":49,"cve_count":11,"kev_count":11,"last_cve_update":41},{"title":125,"metaDescription":126,"keywords":127,"structuredData":128},"Gnupg - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Gnupg covering 7 products with 48 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Gnupg vulnerabilities, Gnupg security, Gnupg CVE, Gnupg threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":129,"@type":130,"name":131,"description":126,"url":132},"https:\u002F\u002Fschema.org","Organization","Gnupg","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fgnupg",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":134,"apiVersion":135},"2026-10-17T19:17:48.800Z","3.0"]