Signalk vulnerabilities

Products

• Signalk-server 17
• Signal K Server 14

Newest

• signalk signalk-server Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs CVE-2026-118690 9.3 CriticalOctober 28, 2026
• signalk signalk-server Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon CVE-2026-115752 Fix available 2.3 LowOctober 23, 2026
• signalk signalk-server Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints CVE-2026-55591 Fix available 5.8 MediumJune 18, 2026
• signalk signal k server, signalk-server +1 more Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) CVE-2026-41893 Fix available 8.7 HighMay 4, 2026
• signalk signal k server, signalk-server +1 more Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths CVE-2026-39320 Fix available 7.5 HighApril 21, 2026
• signalk signal k server, signalk-server +1 more signalk-server: Arbitrary Prototype Read via `from` Field Bypass CVE-2026-35038 Fix available 2.1 LowApril 2, 2026
• signalk signal k server, signalk-server +1 more signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow CVE-2026-34083 Fix available 6.1 MediumApril 2, 2026
• signalk signal k server, signalk-server +1 more signalk-server: Unauthenticated Source Priorities Manipulation CVE-2026-33951 Fix available 6.9 MediumApril 2, 2026
• signalk signal k server, signalk-server +1 more signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-33950 Fix available 9.4 CriticalApril 2, 2026
• signalk signal k server, signalk-server +1 more SignalK Server has Path Traversal leading to information disclosure CVE-2026-25228 Fix available 5.0 MediumFebruary 2, 2026
• signalk signal k server, signalk-server +1 more RCE - Command Injection in Signal K set-system-time plugin CVE-2026-23515 Fix available 10.0 CriticalFebruary 2, 2026
• signalk signal k server, signalk-server +1 more Signal K Server Vulnerable to Access Request Spoofing CVE-2025-69203 Fix available 6.3 MediumJanuary 1, 2026
• signalk signal k server, signalk-server +1 more Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package CVE-2025-68619 Fix available 7.3 HighJanuary 1, 2026
• signalk signal k server, signalk-server +1 more Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling CVE-2025-68620 Fix available 9.1 CriticalJanuary 1, 2026
• signalk signal k server, signalk-server +1 more Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints CVE-2025-68273 Fix available 5.3 MediumJanuary 1, 2026
• signalk signal k server, signalk-server +1 more Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding CVE-2025-68272 Fix available 7.5 HighJanuary 1, 2026
• signalk signal k server, signalk-server +1 more Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) CVE-2025-66398 Public exploitFix available EPSS 19.9% 9.7 CriticalJanuary 1, 2026