Product by Signalk
Signalk-server
17 known vulnerabilities in Signalk-server (Signalk), 0 of them actively exploited (CISA KEV).
Key figures
17
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-66398 | Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) | 9.7 | |
| Critical | CVE-2026-23515 | RCE - Command Injection in Signal K set-system-time plugin | 10.0 | |
| Critical | CVE-2026-118690 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs | 9.8 | |
| Critical | CVE-2025-68620 | Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling | 9.1 | |
| Critical | CVE-2026-33950 | signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity | 9.4 | |
| High | CVE-2025-68619 | Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package | 7.2 | |
| High | CVE-2025-68272 | Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding | 7.5 | |
| Medium | CVE-2025-68273 | Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints | 5.3 | |
| High | CVE-2026-41893 | Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) | 7.5 | |
| High | CVE-2026-39320 | Signalk-server: Inefficient Regular Expression Complexity | 7.5 | |
| Medium | CVE-2026-55591 | Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints | 5.8 | |
| High | CVE-2026-33951 | signalk-server: Unauthenticated Source Priorities Manipulation | 7.5 | |
| Medium | CVE-2026-35038 | signalk-server: Arbitrary Prototype Read via `from` Field Bypass | 6.5 | |
| Medium | CVE-2026-115752 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | 4.2 | |
| Medium | CVE-2026-25228 | SignalK Server has Path Traversal leading to information disclosure | 5.0 | |
| High | CVE-2025-69203 | Signal K Server Vulnerable to Access Request Spoofing | 6.3 | |
| Medium | CVE-2026-34083 | signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow | 6.1 |