SignalK signalk-server
17 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118690 | < 2.33.0 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs | CRITICAL 9.3 | 0.7 % | ||
| CVE-2026-115752 | 2.28.0-beta.2 – < 2.34.0 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | LOW 2.3 | 0.2 % | ||
| CVE-2026-55591 | < 2.28.0 | Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints | MEDIUM 5.8 | 0.3 % | ||
| CVE-2026-41893 | < 2.25.0 | Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) | HIGH 8.7 | 0.3 % | ||
| CVE-2026-39320 | < 2.25.0 | Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths | HIGH 7.5 | 0.4 % | ||
| CVE-2026-35038 | < 2.24.0 | signalk-server: Arbitrary Prototype Read via `from` Field Bypass | LOW 2.1 | 0.3 % | ||
| CVE-2026-34083 | < 2.24.0 | signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-33951 | < 2.24.0-beta.1 | signalk-server: Unauthenticated Source Priorities Manipulation | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-33950 | < 2.24.0-beta.4 | signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-25228 | < 2.20.3 | SignalK Server has Path Traversal leading to information disclosure | MEDIUM 5.0 | 0.4 % | ||
| CVE-2026-23515 | < 1.5.0 | RCE - Command Injection in Signal K set-system-time plugin | CRITICAL 10.0 | 4.5 % | ||
| CVE-2025-69203 | < 2.19.0 | Signal K Server Vulnerable to Access Request Spoofing | HIGH 8.8 | 0.3 % | ||
| CVE-2025-68619 | < 2.19.0 | Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package | HIGH 7.3 | 0.7 % | ||
| CVE-2025-68620 | < 2.19.0 | Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-68273 | < 2.19.0 | Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints | MEDIUM 5.3 | 0.8 % | ||
| CVE-2025-68272 | < 2.19.0 | Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding | HIGH 7.5 | 0.6 % | ||
| CVE-2025-66398 | < 2.19.0 | Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) | CRITICAL 9.7 | 20 % |