CVE Tools
Track your stack

Signal

2 CVEs tracked since 2018. Since Aug 2018, none of them reached CISA KEV.

Signal CVEs per month

Aug 2018 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Signal CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-0820
2018-092 or fewer
2018-102 or fewer
2018-11no snapshot
2018-122 or fewer
2019-01no snapshot
2019-021 or fewer
2019-03no snapshot
2019-04no snapshot
2019-051 or fewer
2019-06no snapshot
2019-072 or fewer
2019-082 or fewer
2019-092 or fewer
2019-102 or fewer
2019-112 or fewer
2019-122 or fewer
2020-012 or fewer
2020-022 or fewer
2020-032 or fewer
2020-04no snapshot
2020-05no snapshot
2020-062 or fewer
2020-07no snapshot
2020-082 or fewer
2020-091 or fewer
2020-101 or fewer
2020-111 or fewer
2020-122 or fewer
2021-012 or fewer
2021-022 or fewer
2021-03no snapshot
2021-042 or fewer
2021-052 or fewer
2021-062 or fewer
2021-072 or fewer
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-122 or fewer
2022-012 or fewer
2022-022 or fewer
2022-033 or fewer
2022-043 or fewer
2022-053 or fewer
2022-063 or fewer
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Signal's monthly top three, with their CVEs summed over those months.

  1. Signal11 month
  2. Signal-desktop11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Signal.

  1. CVE-2026-113380In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video tr...—
  2. CVE-2025-5715Signal App Biometric Authentication missing critical step in authentication3.8
  3. CVE-2023-24069Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments a...3.3
  4. CVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modificat...7.8
  5. CVE-2022-28345The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. T...7.5
  6. CVE-2020-5753Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handl...5.3
  7. CVE-2019-19954Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.7.3
  8. CVE-2019-17191The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call ...7.5
  9. CVE-2019-17192The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it eas...9.8
  10. CVE-2019-9970Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages co...6.5
  11. CVE-2018-3988Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave t...4.7
  12. CVE-2018-16132The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This all...8.6
  13. CVE-2018-14023Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.4.0
  14. CVE-2018-11101Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a rep...6.1
  15. CVE-2018-10994js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.6.1

The record

Peak rank
#189 in Aug 2018
Busiest month shown
Aug 2018, 2 CVEs
Months with a KEV entry
0 since Aug 2018
Monthly snapshots
1 since 2018
Signal's full record, month by month