Skip to contentSignalk Signal K Server vulnerabilities
- signalk signal k server, signalk-server +1 moreSignal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)CVE-2026-41893Fix available8.7 High
- signalk signal k server, signalk-server +1 moreSignal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription PathsCVE-2026-39320Fix available7.5 High
- signalk signal k server, signalk-server +1 moresignalk-server: Arbitrary Prototype Read via `from` Field BypassCVE-2026-35038Fix available2.1 Low
- signalk signal k server, signalk-server +1 moresignalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowCVE-2026-34083Fix available6.1 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Unauthenticated Source Priorities ManipulationCVE-2026-33951Fix available6.9 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Privilege Escalation by Admin Role Injection via /enableSecurityCVE-2026-33950Fix available9.4 Critical
- signalk signal k server, signalk-server +1 moreSignalK Server has Path Traversal leading to information disclosureCVE-2026-25228Fix available5.0 Medium
- signalk signal k server, signalk-server +1 moreRCE - Command Injection in Signal K set-system-time pluginCVE-2026-23515Fix available10.0 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Access Request SpoofingCVE-2025-69203Fix available6.3 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Remote Code Execution via Malicious npm PackageCVE-2025-68619Fix available7.3 High
- signalk signal k server, signalk-server +1 moreSignal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated PollingCVE-2025-68620Fix available9.1 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsCVE-2025-68273Fix available5.3 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingCVE-2025-68272Fix available7.5 High
- signalk signal k server, signalk-server +1 moreSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)CVE-2025-66398Public exploitFix availableEPSS 19.9%9.7 Critical