Vulnerabilities

TI-2026-22096 CVE-2026-27736

BigBlueButton has Open Redirect vulnerability in ApiController

LOW 26

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00175 Published 2026-02-25 Fixed in 3.0.20 CWE-601

TI-2026-21874 CVE-2026-27467

BigBlueButton: Audio from participants to the server initially unmuted

LOW 12

BigBlueButton is an open-source virtual classroom.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00207 Published 2026-02-21 Fixed in 3.0.20 CWE-200

TI-2026-21873 CVE-2026-27466

BigBlueButton: Exposed ClamAV port enables Denial of Service

HIGH 75

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00452 Published 2026-02-21 Fixed in 3.0.22 CWE-668

TI-2025-38047 CVE-2025-61602

BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId

HIGH 72

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00393 Published 2025-10-09 Fixed in 3.0.13 CWE-703

TI-2025-38046 CVE-2025-61601

BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

HIGH 72

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00472 Published 2025-10-09 Fixed in 3.0.13 CWE-703

TI-2025-34876 CVE-2025-55200

BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes

LOW 31

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00249 Published 2025-10-09 Fixed in 3.0.13 CWE-79

TI-2023-23489 CVE-2023-43798

BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)

LOW 26

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00478 Published 2023-10-30 Fixed in 2.6.12, 2.7.0-rc.1 CWE-918

TI-2023-23488 CVE-2023-43797

BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

LOW 28

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.0047 Published 2023-10-30 Fixed in 2.6.11, 2.7.0-beta.3 CWE-79

TI-2023-22895 CVE-2023-42804

BigBlueButton Path Traversal – Reading Certain File Extensions

LOW 25

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00552 Published 2023-10-30 Fixed in 2.6.0-beta.1 CWE-22

TI-2023-22894 CVE-2023-42803

BigBlueButton Unrestricted File Upload vulnerability

LOW 39

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00659 Published 2023-10-30 Fixed in 2.6.0-beta.2 CWE-434

TI-2023-16353 CVE-2023-33176

Blind SSRF When Uploading Presentation in BigBlueButton

LOW 29

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00471 Published 2023-06-26 Fixed in 2.6.9, 2.5.18 CWE-918

TI-2022-07548 CVE-2022-23488

BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data

LOW 34

BigBlueButton is an open source web conferencing system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00618 Published 2022-12-17 Fixed in 2.4-rc-6 CWE-200

TI-2022-07549 CVE-2022-23490

Improper access control to polling votes

LOW 20

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00472 Published 2022-12-16 Fixed in 2.4.0 CWE-200

TI-2022-20304 CVE-2022-41964

BigBlueButton contains Response leaks in anonymous polls

LOW 27

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00599 Published 2022-12-16 Fixed in 2.4.0 CWE-200

TI-2022-20303 CVE-2022-41963

BigBlueButton contains Improper Preservation of Permissions for whiteboard

LOW 16

BigBlueButton is an open source web conferencing system.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00453 Published 2022-12-16 Fixed in 2.4.3 CWE-281

TI-2022-20302 CVE-2022-41962

BigBlueButton contains Incorrect Authorization for setting emoji status

LOW 15

BigBlueButton is an open source web conferencing system.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00711 Published 2022-12-16 Fixed in 2.4-rc-6 CWE-863

TI-2022-20301 CVE-2022-41961

BigBlueButton subject to Ineffective user bans

LOW 20

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00304 Published 2022-12-16 Fixed in v2.4-rc-6 CWE-345

TI-2022-20300 CVE-2022-41960

BigBlueButton contains DoS via failed authToken validation

LOW 20

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00392 Published 2022-12-15 Fixed in 2.4.3 CWE-345

TI-2022-13109 CVE-2022-31064

Cross site scripting in username that will trigger by sending chat

MEDIUM 62

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0127 Published 2022-06-27 Fixed in 2.4.8 CWE-79

TI-2022-13110 CVE-2022-31065

Cross site scripting vulnerability for private chat in bigbluebutton

LOW 30

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00792 Published 2022-06-27 Fixed in 2.4.8 CWE-79

TI-2022-10357 CVE-2022-27238 · GHSA-gx92-whgh-j9vf

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting…

LOW 25

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00461 Published 2022-06-24 No fix listed CWE-79

TI-2022-11777 CVE-2022-29235

Limited data exposure for shared external videos in BigBlueButton

LOW 26

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01066 Published 2022-06-01 Fixed in 2.3.18, 2.4-rc-6 CWE-200

TI-2022-11778 CVE-2022-29236

Improper access control for pencil annotations in BigBlueButton

LOW 22

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00886 Published 2022-06-01 Fixed in 2.3.18, 2.4-rc-6 CWE-285

TI-2022-11776 CVE-2022-29234

Grace period for lock settings in public/private chats in BigBlueButton

LOW 22

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0085 Published 2022-06-01 Fixed in 2.3.18, 2.4.1 CWE-285

TI-2022-11775 CVE-2022-29233

Improper access control for breakout rooms in BigBlue Button

LOW 22

BigBlueButton is an open source web conferencing system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01051 Published 2022-06-01 Fixed in 2.3.18, 2.4-rc-1 CWE-285

Vulnerabilities

Filters