Bigbluebutton vulnerabilities

Products

• Bigbluebutton 63
• Greenlight 6

Newest

• bigbluebutton BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass CVE-2026-55489 4.9 MediumAugust 20, 2026
• bigbluebutton BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name CVE-2026-55491 5.4 MediumAugust 20, 2026
• bigbluebutton BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser CVE-2026-46355 7.1 HighAugust 20, 2026
• bigbluebutton BigBlueButton: Blind SQL Injection AUTH (Moderator) CVE-2026-46682 8.5 HighAugust 20, 2026
• bigbluebutton BigBlueButton API checksum bypass via presentationUploadExternalUrl CVE-2026-46353 8.1 HighJuly 16, 2026
• bigbluebutton BigBlueButton: Presentation URL Security Hardening CVE-2026-46404 6.8 MediumJuly 16, 2026
• bigbluebutton BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them CVE-2026-46351 8.1 HighJuly 16, 2026
• bigbluebutton bbb-playback, bigbluebutton, blindsidenetworks scalite +2 more BigBlueButton has Stored XSS in bbb-playback replay CVE-2026-27737 6.5 MediumMay 18, 2026
• bigbluebutton BigBlueButton's missing authorization allows viewer to inject/overwrite captions CVE-2026-41127 6.5 MediumApril 21, 2026
• bigbluebutton BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" CVE-2026-41126 4.3 MediumApril 21, 2026
• bigbluebutton BigBlueButton has Open Redirect vulnerability in ApiController CVE-2026-27736 6.1 MediumFebruary 25, 2026
• bigbluebutton BigBlueButton: Audio from participants to the server initially unmuted CVE-2026-27467 2.0 LowFebruary 21, 2026
• bigbluebutton BigBlueButton: Exposed ClamAV port enables Denial of Service CVE-2026-27466 7.2 HighFebruary 21, 2026
• bigbluebutton BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId CVE-2025-61602 7.5 HighOctober 9, 2025
• bigbluebutton BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation CVE-2025-61601 7.5 HighOctober 9, 2025
• bigbluebutton BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes CVE-2025-55200 7.1 HighOctober 9, 2025
• bigbluebutton BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2023-7296 6.4 MediumOctober 16, 2024
• bigbluebutton Some bbb-record-core files installed with wrong file permission CVE-2024-39302 3.7 LowJune 28, 2024
• bigbluebutton bbb-web API additional parameters considered CVE-2024-38518 4.6 MediumJune 28, 2024
• bigbluebutton greenlight BigBlueButton Greenlight Open Redirect vulnerability CVE-2022-36029 9.1 CriticalApril 25, 2024
• bigbluebutton greenlight BigBlueButton Greenlight Open Redirect vulnerability CVE-2022-36028 9.1 CriticalApril 25, 2024
• bigbluebutton BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass) CVE-2023-43798 5.6 MediumOctober 30, 2023
• bigbluebutton BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby CVE-2023-43797 6.3 MediumOctober 30, 2023
• bigbluebutton BigBlueButton Path Traversal – Reading Certain File Extensions CVE-2023-42804 3.1 LowOctober 30, 2023
• bigbluebutton BigBlueButton Unrestricted File Upload vulnerability CVE-2023-42803 5.3 MediumOctober 30, 2023
• bigbluebutton WordPress BigBlueButton Plugin <= 3.0.0-beta.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-39991 7.1 HighSeptember 4, 2023
• bigbluebutton Blind SSRF When Uploading Presentation in BigBlueButton CVE-2023-33176 4.8 MediumJune 26, 2023
• bigbluebutton BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data CVE-2022-23488 6.5 MediumDecember 17, 2022
• bigbluebutton Improper access control to polling votes CVE-2022-23490 4.3 MediumDecember 16, 2022
• bigbluebutton BigBlueButton contains Response leaks in anonymous polls CVE-2022-41964 5.7 MediumDecember 16, 2022
• bigbluebutton BigBlueButton contains Improper Preservation of Permissions for whiteboard CVE-2022-41963 2.7 LowDecember 16, 2022
• bigbluebutton BigBlueButton contains Incorrect Authorization for setting emoji status CVE-2022-41962 2.7 LowDecember 16, 2022
• bigbluebutton BigBlueButton subject to Ineffective user bans CVE-2022-41961 4.3 MediumDecember 16, 2022
• bigbluebutton BigBlueButton contains DoS via failed authToken validation CVE-2022-41960 4.3 MediumDecember 15, 2022
• bigbluebutton Cross site scripting in username that will trigger by sending chat CVE-2022-31064 6.5 MediumJune 27, 2022
• bigbluebutton Cross site scripting vulnerability for private chat in bigbluebutton CVE-2022-31065 6.5 MediumJune 27, 2022
• bigbluebutton greenlight Improper privilege management - Anyone can view room settings in GreenLight CVE-2022-31039 4.3 MediumJune 27, 2022
• bigbluebutton BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in... CVE-2022-27238 5.4 MediumJune 24, 2022
• bigbluebutton greenlight BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a... CVE-2022-26497 5.4 MediumJune 2, 2022
• bigbluebutton Limited data exposure for shared external videos in BigBlueButton CVE-2022-29235 5.3 MediumJune 1, 2022
• bigbluebutton Improper access control for pencil annotations in BigBlueButton CVE-2022-29236 4.3 MediumJune 1, 2022
• bigbluebutton Grace period for lock settings in public/private chats in BigBlueButton CVE-2022-29234 4.3 MediumJune 1, 2022
• bigbluebutton Improper access control for breakout rooms in BigBlue Button CVE-2022-29233 4.3 MediumJune 1, 2022
• bigbluebutton Exposure of messages in BigBlueButton public chats CVE-2022-29232 6.5 MediumJune 1, 2022
• bigbluebutton ReDoS on endpoint html5client/useragent in BigBlueButton CVE-2022-29169 7.5 HighJune 1, 2022
• bigbluebutton, bigbluebutton bigbluebutton/bigbluebutton +1 more Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton CVE-2021-4143 8.1 HighJanuary 19, 2022
• bigbluebutton An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because... CVE-2020-29042 3.7 LowNovember 26, 2020
• bigbluebutton An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an... CVE-2020-29043 7.5 HighNovember 26, 2020
• bigbluebutton In BigBlueButton before 2.2.29, a user can vote more than once in a single poll. CVE-2020-28953 4.3 MediumNovember 19, 2020
• bigbluebutton web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter... CVE-2020-28954 5.3 MediumNovember 19, 2020
• Show olderLoading…