openpgpjs 相关的公开 CVE 漏洞与安全风险信息，提供 CVSS、EPSS、公开时间与漏洞情报数据，帮助评估潜在风险与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2023-41037 | OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to | [email protected] | 4.3 | 0.31% | 2023-08-29 | 2026-06-17 |
| CVE-2019-9155 | A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key. | [email protected] | 5.9 | 1.48% | 2019-08-22 | 2026-06-16 |
| CVE-2019-9154 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed. | [email protected] | 7.5 | 1.62% | 2019-08-22 | 2026-06-16 |
| CVE-2019-9153 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature. | [email protected] | 7.5 | 2.01% | 2019-08-22 | 2026-06-16 |
| CVE-2015-8013 | s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message. | [email protected] | 7.5 | 3.87% | 2017-07-25 | 2026-06-16 |