What’s Vulnerable › Products

signalk-server vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your signalk-server version is affected

Latest signalk-server vulnerabilities

• CVE-2026-55591 — Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints (CVSS 5.8)
• CVE-2026-41893 — Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) (CVSS 7.5)
• CVE-2026-39320 — Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths (CVSS 7.5)
• CVE-2026-35038 — signalk-server: Arbitrary Prototype Read via `from` Field Bypass (CVSS 6.5)
• CVE-2026-34083 — signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow (CVSS 6.1)
• CVE-2026-33951 — signalk-server: Unauthenticated Source Priorities Manipulation (CVSS 7.5)
• CVE-2026-33950 — signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity (CVSS 9.4)
• CVE-2026-25228 — SignalK Server has Path Traversal leading to information disclosure (CVSS 4.3)
• CVE-2026-23515 — RCE - Command Injection in Signal K set-system-time plugin (CVSS 8.8)
• CVE-2025-69203 — Signal K Server Vulnerable to Access Request Spoofing (CVSS 8.8)
• CVE-2025-68620 — Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling (CVSS 9.1)
• CVE-2025-68619 — Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package (CVSS 7.2)
• CVE-2025-68273 — Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints (CVSS 5.3)
• CVE-2025-68272 — Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding (CVSS 7.5)
• CVE-2025-66398 — Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) (CVSS 8.8)