Vulnerabilities

Filters

1 selected

17 records

Sort

Vendor: SignalK Clear all filters

TI-2026-82216 CVE-2026-118690 · GHSA-4r6j-f6gv-fqcx

Missing authentication in Signal K Server exposes log archives

MEDIUM 49

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00688 Published 2026-10-28 Fixed in 2.33.0 CWE-306

TI-2026-79753 CVE-2026-115752 · GHSA-rjvc-ghm7-354c

Server-side request forgery in Signal K Server App Store icon fetcher

LOW 11

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00175 Published 2026-10-23 Fixed in 2.34.0 CWE-918

TI-2026-40128 CVE-2026-55591 · GHSA-q59x-jc9f-gfqf

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

HIGH 65

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00298 Published 2026-09-15 Fixed in 2.28.0 CWE-918

TI-2026-30295 CVE-2026-41893 · GHSA-vmfm-ch9h-5c7g

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

HIGH 77

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00327 Published 2026-05-09 Fixed in 2.25.0 CWE-307

TI-2026-28309 CVE-2026-39320 · GHSA-7gcj-phff-2884

Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

HIGH 72

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00427 Published 2026-04-21 Fixed in 2.25.0 CWE-1333

TI-2026-27241 CVE-2026-35038 · GHSA-qh3j-mrg8-f234

signalk-server: Arbitrary Prototype Read via `from` Field Bypass

MEDIUM 44

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 4.0LOW 2.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-04-02 Fixed in 2.24.0 CWE-125

TI-2026-26405 CVE-2026-34083 · GHSA-cxj8-ggf2-p57c

signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

MEDIUM 60

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00116 Published 2026-04-02 Fixed in 2.24.0 CWE-346

TI-2026-26301 CVE-2026-33951 · GHSA-gfmv-vh34-h2x5

signalk-server: Unauthenticated Source Priorities Manipulation

LOW 36

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00322 Published 2026-04-02 Fixed in 2.24.0-beta.1 CWE-284

TI-2026-26300 CVE-2026-33950 · GHSA-x8hc-fqv3-7gwf

signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

HIGH 82

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00434 Published 2026-04-02 Fixed in 2.24.0-beta.4 CWE-285

TI-2026-20376 CVE-2026-25228 · GHSA-vrhw-v2hw-jffx

SignalK Server has Path Traversal leading to information disclosure

MEDIUM 56

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00426 Published 2026-02-02 Fixed in 2.20.3 CWE-22

TI-2026-18939 CVE-2026-23515 · GHSA-p8gp-2w28-mhwg

RCE - Command Injection in Signal K set-system-time plugin

HIGH 76

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0452 Published 2026-02-02 Fixed in 1.5.0 CWE-78

TI-2025-42657 CVE-2025-69203 · GHSA-vfrf-vcj7-wvr8

Signal K Server Vulnerable to Access Request Spoofing

HIGH 77

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00303 Published 2026-01-01 Fixed in 2.19.0 CWE-290

TI-2025-42137 CVE-2025-68619 · GHSA-93jc-vqqc-vvvh

Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

HIGH 73

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.00715 Published 2026-01-01 Fixed in 2.19.0, 2.9.0 CWE-94

TI-2025-42138 CVE-2025-68620 · GHSA-fq56-hvg6-wvm5

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

HIGH 80

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00539 Published 2026-01-01 Fixed in 2.19.0 CWE-288

TI-2025-41849 CVE-2025-68273 · GHSA-fpf5-w967-rr2m

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

MEDIUM 63

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00823 Published 2026-01-01 Fixed in 2.19.0 CWE-200

TI-2025-41848 CVE-2025-68272 · GHSA-7rqc-ff8m-7j23

Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

HIGH 72

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00564 Published 2026-01-01 Fixed in 2.19.0 CWE-400

TI-2025-40835 CVE-2025-66398 · GHSA-w3x5-7c4c-66p9

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

HIGH 82

Signal K Server is a server application that runs on a central hub in a boat.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.1985 Published 2026-01-01 Fixed in 2.19.0 CWE-78