Vulnerabilities

TI-2026-40044 CVE-2026-55489

BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

LOW 22

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00311 Published 2026-08-20 Fixed in 3.0.29 CWE-639

TI-2026-40046 CVE-2026-55491

BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

LOW 24

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00289 Published 2026-08-20 Fixed in 3.0.29 CWE-79

TI-2026-34072 CVE-2026-46355

BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

LOW 31

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0037 Published 2026-08-20 Fixed in 3.0.23 CWE-287

TI-2026-34313 CVE-2026-46682

BigBlueButton: Blind SQL Injection AUTH (Moderator)

LOW 38

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00579 Published 2026-08-20 Fixed in 3.0.23 CWE-89

TI-2026-34070 CVE-2026-46353

BigBlueButton API checksum bypass via presentationUploadExternalUrl

LOW 38

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-07-16 Fixed in 3.0.21 CWE-284

TI-2026-34118 CVE-2026-46404

BigBlueButton: Presentation URL Security Hardening

LOW 30

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00435 Published 2026-07-16 Fixed in 3.0.23 CWE-918

TI-2026-34068 CVE-2026-46351

BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

LOW 38

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00462 Published 2026-07-16 Fixed in 3.0.21 CWE-330

TI-2026-22097 CVE-2026-27737

BigBlueButton has Stored XSS in bbb-playback replay

LOW 28

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-05-18 Fixed in 3.0.19, 1.7.0 +1 CWE-79

TI-2026-29755 CVE-2026-41127

BigBlueButton's missing authorization allows viewer to inject/overwrite captions

LOW 28

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00178 Published 2026-04-21 Fixed in 3.0.24 CWE-639

TI-2026-29754 CVE-2026-41126

BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"

LOW 20

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00231 Published 2026-04-21 Fixed in 3.0.24 CWE-601

TI-2026-22096 CVE-2026-27736

BigBlueButton has Open Redirect vulnerability in ApiController

LOW 26

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00175 Published 2026-02-25 Fixed in 3.0.20 CWE-601

TI-2026-21874 CVE-2026-27467

BigBlueButton: Audio from participants to the server initially unmuted

LOW 12

BigBlueButton is an open-source virtual classroom.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00207 Published 2026-02-21 Fixed in 3.0.20 CWE-200

TI-2026-21873 CVE-2026-27466

BigBlueButton: Exposed ClamAV port enables Denial of Service

HIGH 75

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00452 Published 2026-02-21 Fixed in 3.0.22 CWE-668

TI-2025-38047 CVE-2025-61602

BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId

HIGH 72

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00393 Published 2025-10-09 Fixed in 3.0.13 CWE-703

TI-2025-38046 CVE-2025-61601

BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

HIGH 72

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00472 Published 2025-10-09 Fixed in 3.0.13 CWE-703

TI-2025-34876 CVE-2025-55200

BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes

LOW 31

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00249 Published 2025-10-09 Fixed in 3.0.13 CWE-79

TI-2024-26259 CVE-2024-39302

Some bbb-record-core files installed with wrong file permission

LOW 18

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00458 Published 2024-06-28 Fixed in 2.6.18, 2.7.8 +1 CWE-269

TI-2024-25753 CVE-2024-38518

bbb-web API additional parameters considered

LOW 21

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00307 Published 2024-06-28 Fixed in 2.6.18, 2.7.8 +1 CWE-284

TI-2022-16454 CVE-2022-36029

BigBlueButton Greenlight Open Redirect vulnerability

MEDIUM 47

Greenlight is an end-user interface for BigBlueButton servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0041 Published 2024-04-25 Fixed in 2.13.0 CWE-601

TI-2022-16453 CVE-2022-36028

BigBlueButton Greenlight Open Redirect vulnerability

MEDIUM 47

Greenlight is an end-user interface for BigBlueButton servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00362 Published 2024-04-25 Fixed in 2.13.0 CWE-601

TI-2023-23489 CVE-2023-43798

BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)

LOW 26

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00478 Published 2023-10-30 Fixed in 2.6.12, 2.7.0-rc.1 CWE-918

TI-2023-23488 CVE-2023-43797

BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

LOW 28

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.0047 Published 2023-10-30 Fixed in 2.6.11, 2.7.0-beta.3 CWE-79

TI-2023-22895 CVE-2023-42804

BigBlueButton Path Traversal – Reading Certain File Extensions

LOW 25

BigBlueButton is an open-source virtual classroom.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00552 Published 2023-10-30 Fixed in 2.6.0-beta.1 CWE-22

TI-2023-22894 CVE-2023-42803

BigBlueButton Unrestricted File Upload vulnerability

LOW 39

BigBlueButton is an open-source virtual classroom.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00659 Published 2023-10-30 Fixed in 2.6.0-beta.2 CWE-434

TI-2023-16353 CVE-2023-33176

Blind SSRF When Uploading Presentation in BigBlueButton

LOW 29

BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00471 Published 2023-06-26 Fixed in 2.6.9, 2.5.18 CWE-918

Vulnerabilities

Filters