SI
Vendor
Signal
19
CVEs
0
On KEV
1
New 30D
Products
RI9.3
RingRTC
Signal
1 CVEs0 on KEV1 new
SI7.8
Signal-desktop
Signal
7 CVEs0 on KEV0 new
PM9.8
Private Messenger
Signal
5 CVEs0 on KEV0 new
SI8.6
Signal
Signal
5 CVEs0 on KEV0 new
AP6.4
App
Signal
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113380 | RI RingRTC Signal | 9.3 | Oct 20 | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and… |
| CVE-2025-5715 | AP App Signal | 6.4 | Jun 6 | Signal App Biometric Authentication missing critical step in authentication |
| CVE-2023-24069 | SI Signal-desktop Signal | 3.3 | Jan 23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory |
| CVE-2023-24068 | SI Signal-desktop Signal | 7.8 | Jan 23 | Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory |
| CVE-2022-28345 | SI Signal Signal | 7.5 | Apr 15 | The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection |
| CVE-2020-5753 | PM Private Messenger Signal | 5.3 | May 20 | Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to… |
| CVE-2019-19954 | SI Signal-desktop Signal | 7.3 | Dec 24 | Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file |
| CVE-2019-17192 | PM Private Messenger Signal | 9.8 | Oct 5 | The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which… |
| CVE-2019-17191 | PM Private Messenger Signal | 7.5 | Oct 5 | The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message |
| CVE-2019-9970 | PM Private Messenger Signal | 6.5 | Mar 24 | Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when… |
| CVE-2018-3988 | PM Private Messenger Signal | 4.7 | Dec 10 | Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then… |
| CVE-2018-16132 | SI Signal Signal | 8.6 | Aug 29 | The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating… |
| CVE-2018-14023 | SI Signal-desktop Signal | 4.0 | Aug 20 | Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage |
| CVE-2018-11101 | SI Signal-desktop Signal | 6.1 | May 17 | Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript… |
| CVE-2018-10994 | SI Signal-desktop Signal | 6.1 | May 14 | js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL |
| CVE-2018-9840 | SI Signal Signal | 6.8 | Apr 10 | The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app… |