CVE Tools
Track your stack

Signalk

6 CVEs tracked since 2026. Since Jan 2026, none of them reached CISA KEV.

Signalk CVEs per month

Jan 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Signalk CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0160
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-108 or fewer

Products

The products that kept showing up in Signalk's monthly top three, with their CVEs summed over those months.

  1. Signal K Server61 month
  2. Signalk-server61 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Signalk.

  1. CVE-2026-118690Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs9.8
  2. CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon4.2
  3. CVE-2026-55591Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints5.8
  4. CVE-2026-41893Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)7.5
  5. CVE-2026-39320Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths7.5
  6. CVE-2026-35038signalk-server: Arbitrary Prototype Read via `from` Field Bypass6.5
  7. CVE-2026-34083signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow6.1
  8. CVE-2026-33951signalk-server: Unauthenticated Source Priorities Manipulation7.5
  9. CVE-2026-33950signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity9.4
  10. CVE-2026-25228SignalK Server has Path Traversal leading to information disclosure5.0
  11. CVE-2026-23515RCE - Command Injection in Signal K set-system-time plugin9.9
  12. CVE-2025-69203Signal K Server Vulnerable to Access Request Spoofing6.3
  13. CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package7.2
  14. CVE-2025-68620Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling9.1
  15. CVE-2025-68273Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints5.3

The record

Peak rank
#161 in Jan 2026
Busiest month shown
Jan 2026, 6 CVEs
Months with a KEV entry
0 since Jan 2026
Monthly snapshots
1 since 2026
Signalk's full record, month by month