Login Request a demo
SI
Product
signalk-server
by SignalK · last CVE Oct 28, 2026
17
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 3High 8Medium 6Low 0
Severity
All severities17Critical3High8Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add signalk-server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-23515
8.8
5%
Feb 2
RCE - Command Injection in Signal K set-system-time plugin
Affected: < 1.5.0
CVE-2025-69203
8.8
0%
Jan 1
Signal K Server Vulnerable to Access Request Spoofing
Affected: < 2.19.0
CVE-2025-66398
8.8
20%
Jan 1
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Affected: < 2.19.0
CVE-2026-41893
7.5
0%
May 9
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Affected: < 2.25.0
CVE-2026-39320
7.5
0%
Apr 21
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Affected: < 2.25.0
CVE-2026-33951
7.5
0%
Apr 2
signalk-server: Unauthenticated Source Priorities Manipulation
Affected: < 2.24.0-beta.1
CVE-2025-68272
7.5
1%
Jan 1
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Affected: < 2.19.0
CVE-2025-68619
7.2
1%
Jan 1
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Affected: < 2.19.0
Showing 8