SSignalK

Products

Exploited and recent CVEs

• CVE-2026-118690 Critical 9.8 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs 0.7%
• CVE-2026-115752 Medium 4.2 Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon 0.2%
• CVE-2026-55591 Medium 5.8 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints 0.3%
• CVE-2026-41893 High 8.7 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) 0.3%
• CVE-2026-39320 High 7.5 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths 0.4%
• CVE-2026-35038 Low 2.1 signalk-server: Arbitrary Prototype Read via `from` Field Bypass 0.3%
• CVE-2026-34083 Medium 6.1 signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow 0.1%
• CVE-2026-33951 Medium 6.9 signalk-server: Unauthenticated Source Priorities Manipulation 0.3%
• CVE-2026-33950 Critical 9.4 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity 0.4%
• CVE-2026-25228 Medium 5.0 SignalK Server has Path Traversal leading to information disclosure 0.4%
• CVE-2026-23515 Critical 10.0 RCE - Command Injection in Signal K set-system-time plugin 4.5%
• CVE-2025-69203 Medium 6.3 Signal K Server Vulnerable to Access Request Spoofing 0.3%
• CVE-2025-68619 High 7.3 Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package 0.7%
• CVE-2025-68620 Critical 9.1 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling 0.5%
• CVE-2025-68273 Medium 5.3 Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints 0.8%
• CVE-2025-68272 High 7.5 Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding 0.6%
• CVE-2025-66398 Critical 9.7 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) 19.9%