VendorsSignal Ksignal_k_serverany version
Vulnerabilities

Signal K Server any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

14CVEs
CVE-2026-23515
RCE - Command Injection in Signal K set-system-time plugin
Published 2026-02-02 · Analyzed
9.9EPSS 0.043
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Published 2026-01-01 · Analyzed
9.6EPSS 0.201
CVE-2026-33950
signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
Published 2026-04-02 · Analyzed
9.4EPSS 0.005
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Published 2026-01-01 · Analyzed
9.1EPSS 0.005
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
Published 2026-01-01 · Analyzed
8.8EPSS 0.003
CVE-2026-41893
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Published 2026-05-09 · Analyzed
8.7EPSS 0.005
CVE-2026-39320
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Published 2026-04-21 · Analyzed
7.5EPSS 0.007
CVE-2025-68272
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Published 2026-01-01 · Analyzed
7.5EPSS 0.006
CVE-2026-33951
signalk-server: Unauthenticated Source Priorities Manipulation
Published 2026-04-02 · Analyzed
7.5EPSS 0.005
CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Published 2026-01-01 · Analyzed
7.3EPSS 0.007
CVE-2026-35038
signalk-server: Arbitrary Prototype Read via `from` Field Bypass
Published 2026-04-02 · Analyzed
6.5EPSS 0.004
CVE-2026-34083
signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Published 2026-04-02 · Analyzed
6.1EPSS 0.001
CVE-2025-68273
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Published 2026-01-01 · Analyzed
5.3EPSS 0.004
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
Published 2026-02-02 · Analyzed
5.0EPSS 0.004