SI
Vendor
SignalK
31
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118690 New | SI signalk-server SignalK | 9.8 | Oct 28 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |
| CVE-2026-115752 New | SI signalk-server SignalK | 4.2 | Oct 23 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon |
| CVE-2026-55591 | SI signalk-server SignalK | 5.8 | Sep 15 | Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints |
| CVE-2026-41893 | SI signalk-server SignalK | 7.5 | May 9 | Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) |
| CVE-2026-39320 | SI signalk-server SignalK | 7.5 | Apr 21 | Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths |
| CVE-2026-35038 | SI signalk-server SignalK | 6.5 | Apr 2 | signalk-server: Arbitrary Prototype Read via `from` Field Bypass |
| CVE-2026-34083 | SI signalk-server SignalK | 6.1 | Apr 2 | signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow |
| CVE-2026-33951 | SI signalk-server SignalK | 7.5 | Apr 2 | signalk-server: Unauthenticated Source Priorities Manipulation |
| CVE-2026-33950 | SI signalk-server SignalK | 9.4 | Apr 2 | signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity |
| CVE-2026-25228 | SI signalk-server SignalK | 4.3 | Feb 2 | SignalK Server has Path Traversal leading to information disclosure |
| CVE-2026-23515 | SI signalk-server SignalK | 8.8 | Feb 2 | RCE - Command Injection in Signal K set-system-time plugin |
| CVE-2025-69203 | SI signalk-server SignalK | 8.8 | Jan 1 | Signal K Server Vulnerable to Access Request Spoofing |
| CVE-2025-68619 | SI signalk-server SignalK | 7.2 | Jan 1 | Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package |
| CVE-2025-68620 | SI signalk-server SignalK | 9.1 | Jan 1 | Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling |
| CVE-2025-68273 | SI signalk-server SignalK | 5.3 | Jan 1 | Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints |
| CVE-2025-68272 | SI signalk-server SignalK | 7.5 | Jan 1 | Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding |
| CVE-2025-66398 | SI signalk-server SignalK | 8.8 | Jan 1 | Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) |