TI-2026-26300 CVE-2026-33950 · GHSA-x8hc-fqv3-7gwf
signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
Priority HIGH 82
Signal K Server is a server application that runs on a central hub in a boat.
SignalK
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
SignalK records in CISA KEVNo SignalK vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records
TI-2025-40835 CVE-2025-66398 · GHSA-w3x5-7c4c-66p9
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Priority HIGH 82
Signal K Server is a server application that runs on a central hub in a boat.
TI-2025-42138 CVE-2025-68620 · GHSA-fq56-hvg6-wvm5
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Priority HIGH 80
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-30295 CVE-2026-41893 · GHSA-vmfm-ch9h-5c7g
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Priority HIGH 77
Signal K Server is a server application that runs on a central hub in a boat.
TI-2025-42657 CVE-2025-69203 · GHSA-vfrf-vcj7-wvr8
Signal K Server Vulnerable to Access Request Spoofing
Priority HIGH 77
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-18939 CVE-2026-23515 · GHSA-p8gp-2w28-mhwg
RCE - Command Injection in Signal K set-system-time plugin
Priority HIGH 76
Signal K Server is a server application that runs on a central hub in a boat.
TI-2025-42137 CVE-2025-68619 · GHSA-93jc-vqqc-vvvh
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Priority HIGH 73
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-28309 CVE-2026-39320 · GHSA-7gcj-phff-2884
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Priority HIGH 72
Signal K Server is a server application that runs on a central hub in a boat.
TI-2025-41848 CVE-2025-68272 · GHSA-7rqc-ff8m-7j23
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Priority HIGH 72
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-40128 CVE-2026-55591 · GHSA-q59x-jc9f-gfqf
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
Priority HIGH 65
Signal K Server is a server application that runs on a central hub in a boat.
TI-2025-41849 CVE-2025-68273 · GHSA-fpf5-w967-rr2m
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Priority MEDIUM 63
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-26405 CVE-2026-34083 · GHSA-cxj8-ggf2-p57c
signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Priority MEDIUM 60
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-20376 CVE-2026-25228 · GHSA-vrhw-v2hw-jffx
SignalK Server has Path Traversal leading to information disclosure
Priority MEDIUM 56
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-82216 CVE-2026-118690 · GHSA-4r6j-f6gv-fqcx
Missing authentication in Signal K Server exposes log archives
Priority MEDIUM 49
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint.
TI-2026-27241 CVE-2026-35038 · GHSA-qh3j-mrg8-f234
signalk-server: Arbitrary Prototype Read via `from` Field Bypass
Priority MEDIUM 44
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-26301 CVE-2026-33951 · GHSA-gfmv-vh34-h2x5
signalk-server: Unauthenticated Source Priorities Manipulation
Priority LOW 36
Signal K Server is a server application that runs on a central hub in a boat.
TI-2026-79753 CVE-2026-115752 · GHSA-rjvc-ghm7-354c
Server-side request forgery in Signal K Server App Store icon fetcher
Priority LOW 11
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs.