CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,049 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,049
Show in the list
Critical, last 7 days
232
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product gnupg:gnupg. Show all products

8 CVEs
Showing 1 to 8.
CVESeverityTitlePublished
CVE-2026-118131Not yet scoredCVE-2026-118131
Assigned by certcc
Oct 27, 2026
CVE-2026-105712Low 3.6gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.
Assigned by mitre
Oct 5, 2026
CVE-2026-57062Low 2.9CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted.
Assigned by mitre
Jun 23, 2026
CVE-2026-24883Low 3.7In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
Assigned by mitre
Jan 27, 2026
CVE-2026-24882High 8.4In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
Assigned by mitre
Jan 27, 2026
CVE-2026-24881High 8.1In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling.
Assigned by mitre
Jan 27, 2026
CVE-2025-68973High 7.8In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input.
Assigned by mitre
Dec 28, 2025
CVE-2025-68972Medium 5.9In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signa…
Assigned by mitre
Dec 27, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.