Log in Start free

bigbluebutton

Products

ProductCVEsExploitedLatest
bigbluebutton38–Aug 20, 2026
greenlight3–Apr 25, 2024
bbb-playback1–May 18, 2026
bigbluebutton/bigbluebutton1–Jan 19, 2022

Exploited and recent CVEs

  • CVE-2026-55489 Medium 4.9 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass 0.3%
  • CVE-2026-55491 Medium 5.4 BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name 0.3%
  • CVE-2026-46355 High 7.1 BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser 0.4%
  • CVE-2026-46682 High 8.5 BigBlueButton: Blind SQL Injection AUTH (Moderator) 0.6%
  • CVE-2026-46353 High 8.1 BigBlueButton API checksum bypass via presentationUploadExternalUrl 0.5%
  • CVE-2026-46404 Medium 6.8 BigBlueButton: Presentation URL Security Hardening 0.4%
  • CVE-2026-46351 High 8.1 BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them 0.5%
  • CVE-2026-27737 Medium 6.5 BigBlueButton has Stored XSS in bbb-playback replay 0.3%
  • CVE-2026-27737 Medium 6.5 BigBlueButton has Stored XSS in bbb-playback replay 0.3%
  • CVE-2026-41127 Medium 6.5 BigBlueButton's missing authorization allows viewer to inject/overwrite captions 0.2%
  • CVE-2026-41126 Medium 4.3 BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" 0.2%
  • CVE-2026-27736 Medium 6.1 BigBlueButton has Open Redirect vulnerability in ApiController 0.2%
  • CVE-2026-27467 Low 2.0 BigBlueButton: Audio from participants to the server initially unmuted 0.2%
  • CVE-2026-27466 High 7.2 BigBlueButton: Exposed ClamAV port enables Denial of Service 0.5%
  • CVE-2025-61602 High 7.5 BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId 0.4%
  • CVE-2025-61601 High 7.5 BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation 0.5%
  • CVE-2025-55200 High 7.1 BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes 0.2%
  • CVE-2024-39302 Low 3.7 Some bbb-record-core files installed with wrong file permission 0.5%
  • CVE-2024-38518 Medium 4.6 bbb-web API additional parameters considered 0.3%
  • CVE-2022-36029 Critical 9.1 BigBlueButton Greenlight Open Redirect vulnerability 0.4%
  • CVE-2022-36028 Critical 9.1 BigBlueButton Greenlight Open Redirect vulnerability 0.4%
  • CVE-2023-43798 Medium 5.6 BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass) 0.5%
  • CVE-2023-43797 Medium 6.3 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby 0.5%
  • CVE-2023-42804 Low 3.1 BigBlueButton Path Traversal – Reading Certain File Extensions 0.6%
  • CVE-2023-42803 Medium 5.3 BigBlueButton Unrestricted File Upload vulnerability 0.7%
  • CVE-2023-33176 Medium 4.8 Blind SSRF When Uploading Presentation in BigBlueButton 0.5%
  • CVE-2022-23488 Medium 6.5 BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data 0.6%
  • CVE-2022-23490 Medium 4.3 Improper access control to polling votes 0.5%
  • CVE-2022-41964 Medium 5.7 BigBlueButton contains Response leaks in anonymous polls 0.6%
  • CVE-2022-41963 Low 2.7 BigBlueButton contains Improper Preservation of Permissions for whiteboard 0.5%