Skip to contentSignalk Signalk-server vulnerabilities
- @signalk resources-provider, signalk signalk-server +1 moreSignal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code executionCVE-2026-123807Public exploitFix available9.8 Critical
- signalk signalk-serverSignal K Server before 2.33.0 Missing Authentication via /skServer/ziplogsCVE-2026-1186909.3 Critical
- signalk signalk-serverSignal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIconCVE-2026-115752Fix available2.3 Low
- signalk signalk-serverSignal K Server: Server-Side Request Forgery via Remote Connection EndpointsCVE-2026-55591Fix available5.8 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)CVE-2026-41893Fix available8.7 High
- signalk signal k server, signalk-server +1 moreSignal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription PathsCVE-2026-39320Fix available7.5 High
- signalk signal k server, signalk-server +1 moresignalk-server: Arbitrary Prototype Read via `from` Field BypassCVE-2026-35038Fix available2.1 Low
- signalk signal k server, signalk-server +1 moresignalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowCVE-2026-34083Fix available6.1 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Unauthenticated Source Priorities ManipulationCVE-2026-33951Fix available6.9 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Privilege Escalation by Admin Role Injection via /enableSecurityCVE-2026-33950Fix available9.4 Critical
- signalk signal k server, signalk-server +1 moreSignalK Server has Path Traversal leading to information disclosureCVE-2026-25228Fix available5.0 Medium
- signalk signal k server, signalk-server +1 moreRCE - Command Injection in Signal K set-system-time pluginCVE-2026-23515Fix available10.0 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Access Request SpoofingCVE-2025-69203Fix available6.3 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Remote Code Execution via Malicious npm PackageCVE-2025-68619Fix available7.3 High
- signalk signal k server, signalk-server +1 moreSignal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated PollingCVE-2025-68620Fix available9.1 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsCVE-2025-68273Fix available5.3 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingCVE-2025-68272Fix available7.5 High
- signalk signal k server, signalk-server +1 moreSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)CVE-2025-66398Public exploitFix availableEPSS 19.9%9.7 Critical