BI
Product
bigbluebutton
61
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 16Medium 36Low 6
Watch
Add bigbluebutton to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46404 | 6.8 | Jul 16 | BigBlueButton: Presentation URL Security Hardening Affected: < 3.0.23 |
| CVE-2026-27737 | 6.5 | May 18 | BigBlueButton has Stored XSS in bbb-playback replay Affected: < 3.0.19 |
| CVE-2026-41127 | 6.5 | Apr 21 | BigBlueButton's missing authorization allows viewer to inject/overwrite captions Affected: < 3.0.24 |
| CVE-2023-33176 | 6.5 | Jun 26 | Blind SSRF When Uploading Presentation in BigBlueButton Affected: >= 2.6.0, < 2.6.9; < 2.5.18 |
| CVE-2022-29232 | 6.5 | Jun 1 | BigBlueButton is an open source web conferencing system Affected: 2.2.0 before 2.3.9; 2.4; 2.4 |
| CVE-2020-27607 | 6.5 | Oct 21 | In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client Affected: before 2.2.28 |
| CVE-2020-27604 | 6.5 | Oct 21 | BigBlueButton before 2.3 does not implement LibreOffice sandboxing Affected: before 2.2.8 |
| CVE-2020-25820 | 6.5 | Oct 21 | BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink… Affected: before 2.2.27 |
| CVE-2026-27736 | 6.1 | Feb 25 | BigBlueButton has Open Redirect vulnerability in ApiController Affected: >= 3.0.0, < 3.0.20 |
| CVE-2022-31065 | 6.1 | Jun 27 | BigBlueButton is an open source web conferencing system Affected: 2.4 before 2.4.8; 2.3.0; 2.4.9; 2.5; 2.5; 2.5; +9 more |
| CVE-2021-4143 | 6.1 | Jan 19 | Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0 Affected: before 2.4.0 |
| CVE-2020-27608 | 6.1 | Oct 21 | In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension… Affected: before 2.2.28 |
| CVE-2020-12113 | 6.1 | Apr 23 | BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used Affected: before 2.2.4 |
| CVE-2022-41964 | 5.7 | Dec 16 | BigBlueButton contains Response leaks in anonymous polls Affected: >= 2.4-alpha-1, < 2.4.0 |
| CVE-2026-55491 | 5.4 | Aug 20 | BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name Affected: < 3.0.29 |
| CVE-2025-55200 | 5.4 | Oct 9 | BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes Affected: < 3.0.13 |
| CVE-2023-43798 | 5.4 | Oct 30 | BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass) Affected: < 2.6.12; >= 2.7.0-alpha.1, < 2.7.0-rc.1 |
| CVE-2023-43797 | 5.4 | Oct 30 | BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby Affected: < 2.6.11; >= 2.7.0-alpha.1, < 2.7.0-beta.3 |
| CVE-2022-31064 | 5.4 | Jun 27 | BigBlueButton is an open source web conferencing system Affected: 2.4 before 2.4.8; 2.3.0; 2.4.9; 2.5; 2.5; 2.5; +9 more |
| CVE-2022-27238 | 5.4 | Jun 24 | BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality Affected: through 2.4.7 |
| CVE-2023-42804 | 5.3 | Oct 30 | BigBlueButton Path Traversal – Reading Certain File Extensions Affected: < 2.6.0-beta.1 |
| CVE-2022-29235 | 5.3 | Jun 2 | BigBlueButton is an open source web conferencing system Affected: 2.2.0 before 2.3.18; 2.4; 2.4; 2.4; 2.4; 2.4; +5 more |
| CVE-2020-28954 | 5.3 | Nov 19 | web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name Affected: before 2.2.29 |
| CVE-2020-27609 | 5.3 | Oct 21 | BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface Affected: through 2.2.28 |
| CVE-2020-27606 | 5.3 | Oct 21 | BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie… Affected: before 2.2.28 |
| CVE-2026-55489 | 4.9 | Aug 20 | BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass Affected: < 3.0.29 |
| CVE-2024-38518 | 4.6 | Jun 28 | bbb-web API additional parameters considered Affected: < 2.6.18; >= 2.7.0, < 2.7.8; >= 2.8.0, < 3.0.0-alpha.7 |
| CVE-2026-41126 | 4.3 | Apr 21 | BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" Affected: < 3.0.24 |
| CVE-2022-23490 | 4.3 | Dec 16 | Improper access control to polling votes Affected: < 2.4.0 |
| CVE-2022-41961 | 4.3 | Dec 16 | BigBlueButton subject to Ineffective user bans Affected: < v2.4-rc-6 |
| CVE-2022-41960 | 4.3 | Dec 15 | BigBlueButton contains DoS via failed authToken validation Affected: < 2.4.3 |
| CVE-2022-29236 | 4.3 | Jun 2 | BigBlueButton is an open source web conferencing system Affected: 2.2.0 before 2.3.18; 2.4; 2.4; 2.4; 2.4; 2.4; +5 more |
| CVE-2022-29234 | 4.3 | Jun 2 | BigBlueButton is an open source web conferencing system Affected: 2.2.0 before 2.3.18; 2.4 before 2.4.1 |
| CVE-2022-29233 | 4.3 | Jun 2 | BigBlueButton is an open source web conferencing system Affected: 2.2.0 before 2.3.18; 2.4; 2.4; 2.4; 2.4; 2.4; +1 more |
| CVE-2020-28953 | 4.3 | Nov 19 | In BigBlueButton before 2.2.29, a user can vote more than once in a single poll Affected: before 2.2.29 |
| CVE-2020-27612 | 4.3 | Oct 21 | Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to… Affected: through 2.2.28 |
Showing 36