SignalK vulnerabilities

Newest CVEs

• CVE-2026-118690

  Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

  SignalK · signalk-server

  Critical9.3
• CVE-2026-115752

  Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

  SignalK · signalk-server

  Low2.3
• CVE-2026-55591

  Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

  SignalK · signalk-server

  Medium5.8
• CVE-2026-41893

  Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

  SignalK · signalk-server

  High8.7
• CVE-2026-39320

  Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

  SignalK · signalk-server

  High7.5
• CVE-2026-35038

  signalk-server: Arbitrary Prototype Read via `from` Field Bypass

  SignalK · signalk-server

  Low2.1
• CVE-2026-34083

  signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

  SignalK · signalk-server

  Medium6.1
• CVE-2026-33951

  signalk-server: Unauthenticated Source Priorities Manipulation

  SignalK · signalk-server

  Medium6.9
• CVE-2026-33950

  signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

  SignalK · signalk-server

  Critical9.4
• CVE-2026-25228

  SignalK Server has Path Traversal leading to information disclosure

  SignalK · signalk-server

  Medium5.0