CVE Tools
Track your stack

Signalk-server

17 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Signalk-server, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Signalk-server CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Signalk-server CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-016
2026-022
2026-030
2026-045
2026-051
2026-060
2026-070
2026-080
2026-091
2026-102

Severity

How the 17 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical529%
  • High529%
  • Medium741%

Latest CVEs

The 15 most recently published vulnerabilities affecting Signalk-server.

  1. CVE-2026-118690Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs9.8
  2. CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon4.2
  3. CVE-2026-55591Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints5.8
  4. CVE-2026-41893Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)7.5
  5. CVE-2026-39320Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths7.5
  6. CVE-2026-35038signalk-server: Arbitrary Prototype Read via `from` Field Bypass6.5
  7. CVE-2026-34083signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow6.1
  8. CVE-2026-33951signalk-server: Unauthenticated Source Priorities Manipulation7.5
  9. CVE-2026-33950signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity9.4
  10. CVE-2026-25228SignalK Server has Path Traversal leading to information disclosure5.0
  11. CVE-2026-23515RCE - Command Injection in Signal K set-system-time plugin9.9
  12. CVE-2025-69203Signal K Server Vulnerable to Access Request Spoofing6.3
  13. CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package7.2
  14. CVE-2025-68620Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling9.1
  15. CVE-2025-68273Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints5.3

Product grouping is registry-driven, with AI assist and human review. How it works