Login Request a demo
BI
Vendor
bigbluebutton
3 products with CVEs on record
68
CVEs
0
On KEV
0
New 30D
Products
BI
bigbluebutton
bigbluebutton
9.8
61 CVEs0 on KEV0 new
GR
greenlight
bigbluebutton
8.8
6 CVEs0 on KEV0 new
BB
bbb-playback
bigbluebutton
6.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-55489
BI
bigbluebutton
bigbluebutton
4.9
0%
Aug 20BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
CVE-2026-55491
BI
bigbluebutton
bigbluebutton
5.4
0%
Aug 20BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
CVE-2026-46355
BI
bigbluebutton
bigbluebutton
7.1
0%
Aug 20BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
CVE-2026-46682
BI
bigbluebutton
bigbluebutton
8.5
1%
Aug 20BigBlueButton: Blind SQL Injection AUTH (Moderator)
CVE-2026-46353
BI
bigbluebutton
bigbluebutton
8.1
0%
Jul 16BigBlueButton API checksum bypass via presentationUploadExternalUrl
CVE-2026-46404
BI
bigbluebutton
bigbluebutton
6.8
0%
Jul 16BigBlueButton: Presentation URL Security Hardening
CVE-2026-46351
BI
bigbluebutton
bigbluebutton
8.1
0%
Jul 16BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
CVE-2026-27737
BI
bigbluebutton
bigbluebutton
6.5
0%
May 18BigBlueButton has Stored XSS in bbb-playback replay
CVE-2026-41127
BI
bigbluebutton
bigbluebutton
6.5
0%
Apr 21BigBlueButton's missing authorization allows viewer to inject/overwrite captions
CVE-2026-41126
BI
bigbluebutton
bigbluebutton
4.3
0%
Apr 21BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
CVE-2026-27736
BI
bigbluebutton
bigbluebutton
6.1
0%
Feb 25BigBlueButton has Open Redirect vulnerability in ApiController
CVE-2026-27467
BI
bigbluebutton
bigbluebutton
2.4
0%
Feb 21BigBlueButton: Audio from participants to the server initially unmuted
CVE-2026-27466
BI
bigbluebutton
bigbluebutton
8.2
0%
Feb 21BigBlueButton: Exposed ClamAV port enables Denial of Service
CVE-2025-61602
BI
bigbluebutton
bigbluebutton
7.5
0%
Oct 9BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
CVE-2025-61601
BI
bigbluebutton
bigbluebutton
7.5
0%
Oct 9BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
CVE-2025-55200
BI
bigbluebutton
bigbluebutton
5.4
0%
Oct 9BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
CVE-2024-39302
BI
bigbluebutton
bigbluebutton
3.7
0%
Jun 28Some bbb-record-core files installed with wrong file permission
CVE-2024-38518
BI
bigbluebutton
bigbluebutton
4.6
0%
Jun 28bbb-web API additional parameters considered
CVE-2022-36029
GR
greenlight
bigbluebutton
6.1
0%
Apr 25BigBlueButton Greenlight Open Redirect vulnerability
CVE-2022-36028
GR
greenlight
bigbluebutton
6.1
0%
Apr 25BigBlueButton Greenlight Open Redirect vulnerability
CVE-2023-43798
BI
bigbluebutton
bigbluebutton
5.4
0%
Oct 30BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)
CVE-2023-43797
BI
bigbluebutton
bigbluebutton
5.4
0%
Oct 30BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
CVE-2023-42804
BI
bigbluebutton
bigbluebutton
5.3
0%
Oct 30BigBlueButton Path Traversal – Reading Certain File Extensions
CVE-2023-42803
BI
bigbluebutton
bigbluebutton
8.8
1%
Oct 30BigBlueButton Unrestricted File Upload vulnerability
CVE-2023-33176
BI
bigbluebutton
bigbluebutton
6.5
0%
Jun 26Blind SSRF When Uploading Presentation in BigBlueButton
CVE-2022-23488
BI
Bigbluebutton
Bigbluebutton
7.5
1%
Dec 17BigBlueButton is an open source web conferencing system
CVE-2022-23490
BI
Bigbluebutton
Bigbluebutton
4.3
0%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-41964
BI
Bigbluebutton
Bigbluebutton
5.7
1%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-41963
BI
Bigbluebutton
Bigbluebutton
3.1
0%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-41962
BI
Bigbluebutton
Bigbluebutton
2.7
1%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-41961
BI
Bigbluebutton
Bigbluebutton
4.3
0%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-41960
BI
Bigbluebutton
Bigbluebutton
4.3
0%
Dec 16BigBlueButton is an open source web conferencing system
CVE-2022-31065
BI
Bigbluebutton
Bigbluebutton
6.1
1%
Jun 27BigBlueButton is an open source web conferencing system
CVE-2022-31064
BI
Bigbluebutton
Bigbluebutton
5.4
1%
Jun 27BigBlueButton is an open source web conferencing system
CVE-2022-31039
GR
Greenlight
Bigbluebutton
5.3
1%
Jun 27Greenlight is a simple front-end interface for your BigBlueButton server
CVE-2022-27238
BI
Bigbluebutton
Bigbluebutton
5.4
0%
Jun 24BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality
CVE-2022-26497
GR
Greenlight
Bigbluebutton
5.4
1%
Jun 2BigBlueButton Greenlight 2.11.1 allows XSS
CVE-2022-29236
BI
Bigbluebutton
Bigbluebutton
4.3
1%
Jun 2BigBlueButton is an open source web conferencing system
CVE-2022-29235
BI
Bigbluebutton
Bigbluebutton
5.3
1%
Jun 2BigBlueButton is an open source web conferencing system
CVE-2022-29234
BI
Bigbluebutton
Bigbluebutton
4.3
1%
Jun 2BigBlueButton is an open source web conferencing system
CVE-2022-29233
BI
Bigbluebutton
Bigbluebutton
4.3
1%
Jun 2BigBlueButton is an open source web conferencing system
CVE-2022-29232
BI
Bigbluebutton
Bigbluebutton
6.5
1%
Jun 1BigBlueButton is an open source web conferencing system
CVE-2022-29169
BI
Bigbluebutton
Bigbluebutton
7.5
2%
Jun 1BigBlueButton is an open source web conferencing system
CVE-2021-4143
BI
Bigbluebutton
Bigbluebutton
6.1
1%
Jan 19Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0
CVE-2020-29043
BI
Bigbluebutton
Bigbluebutton
7.5
1%
Nov 26An issue was discovered in BigBlueButton through 2.2.29
CVE-2020-29042
BI
Bigbluebutton
Bigbluebutton
3.7
1%
Nov 26An issue was discovered in BigBlueButton through 2.2.29
CVE-2020-28954
BI
Bigbluebutton
Bigbluebutton
5.3
1%
Nov 19web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name
CVE-2020-28953
BI
Bigbluebutton
Bigbluebutton
4.3
1%
Nov 19In BigBlueButton before 2.2.29, a user can vote more than once in a single poll
CVE-2020-27642
GR
Greenlight
Bigbluebutton
6.1
1%
Oct 22A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6
CVE-2020-27613
BI
Bigbluebutton
Bigbluebutton
8.4
0%
Oct 21The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access
CVE-2020-27612
BI
Bigbluebutton
Bigbluebutton
4.3
1%
Oct 21Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to…
CVE-2020-27611
BI
Bigbluebutton
Bigbluebutton
7.3
1%
Oct 21BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint
CVE-2020-27610
BI
Bigbluebutton
Bigbluebutton
7.5
1%
Oct 21The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall…
CVE-2020-27609
BI
Bigbluebutton
Bigbluebutton
5.3
1%
Oct 21BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface
CVE-2020-27608
BI
Bigbluebutton
Bigbluebutton
6.1
1%
Oct 21In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension…
CVE-2020-27607
BI
Bigbluebutton
Bigbluebutton
6.5
1%
Oct 21In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client
CVE-2020-27606
BI
Bigbluebutton
Bigbluebutton
5.3
1%
Oct 21BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie…
CVE-2020-27605
BI
Bigbluebutton
Bigbluebutton
9.8
1%
Oct 21BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
CVE-2020-27604
BI
Bigbluebutton
Bigbluebutton
6.5
1%
Oct 21BigBlueButton before 2.3 does not implement LibreOffice sandboxing
CVE-2020-27603
BI
Bigbluebutton
Bigbluebutton
7.5
3%
Oct 21BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files