CVE-2019-9154: Openpgpjs

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.

Affected products

• Openpgpjs Openpgpjs: up to and including 4.1.2

Published 2019-08-22. Last modified 2026-06-17.