PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-47934] Critical signature-spoofing vulnerability in OpenPGP.js hits the headlines

yeswehack.com | vulnerability | CVE-2025-47934 | #bug-bounty | #cryptography | #vulnerability | #openpgpjs | #cve-2025-47934 | #signature-spoofing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2025-47934: Codean Labs researchers found a critical OpenPGP.js signature-spoofing flaw via YesWeHack's Bug Bounty program (€7,500 bounty), covering discovery, remediation and disclosure.
CVE
CVE-2025-47934
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
vulnerability · projectdiscovery.io
Introducing Neo Triage
On October 26, 2026 we're releasing Neo Triage, an autonomous engine for vulnerability triage. While other tools rank your backlog, Neo clears it.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · yeswehack.com
‘AI slop’ bug reports and outsourcing triage, OpenPGP.js signature-spoofing bug, race to combat zero-day exploits – OffSec roundup for CISOs
CISO roundup: the deluge of AI-generated 'slop' bug reports and calls to outsource triage, the OpenPGP.js signature-spoofing bug, and Google's analysis of zero-day exploitation trends.
vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Back