Security
فارسی
All products

signalk-server

npm · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Signal K Server: Buffered logs exposed to unauthenticated WebSocket clientsGHSA-7M8X-X364-M26J signalk-server npm Medium Fix reported
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionCVE-2026-123807 · GHSA-4XM8-RG9H-JHQ2 @signalk/resources-providersignalk-server npm Critical Fix reported
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherCVE-2026-115752 · GHSA-7WPF-CH8F-5F4X signalk-server npm Medium Fix reported
Signal K Server: Server-Side Request Forgery via Remote Connection EndpointsCVE-2026-55591 · GHSA-Q59X-JC9F-GFQF signalk-server npm Medium Fix reported
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)CVE-2026-41893 · GHSA-VMFM-CH9H-5C7G signalk-server npm High Fix reported
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingCVE-2025-68272 · GHSA-7RQC-FF8M-7J23 signalk-server npm High Fix reported
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsCVE-2025-68273 · GHSA-FPF5-W967-RR2M signalk-server npm Medium Fix reported
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)CVE-2025-66398 · GHSA-W3X5-7C4C-66P9 signalk-server npm Critical Fix reported
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription PathsCVE-2026-39320 · GHSA-7GCJ-PHFF-2884 signalk-server npm High Fix reported
Signal K Server: Unauthenticated Source Priorities Manipulation CVE-2026-33951 · GHSA-GFMV-VH34-H2X5 signalk-server npm Medium Fix reported
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowCVE-2026-34083 · GHSA-CXJ8-GGF2-P57C signalk-server npm Medium Fix reported
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-33950 · GHSA-X8HC-FQV3-7GWF signalk-server npm Critical Fix reported
Signal K Server: Arbitrary Prototype Read via `from` Field BypassCVE-2026-35038 · GHSA-QH3J-MRG8-F234 signalk-server npm Low Fix reported
SignalK Server has Path Traversal leading to information disclosureCVE-2026-25228 · GHSA-VRHW-V2HW-JFFX signalk-server npm Medium Fix reported
Signal K Server Vulnerable to Remote Code Execution via Malicious npm PackageCVE-2025-68619 · GHSA-93JC-VQQC-VVVH signalk-server npm High Fix reported
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated PollingCVE-2025-68620 · GHSA-FQ56-HVG6-WVM5 signalk-server npm Critical Fix reported
Signal K Server Vulnerable to Access Request SpoofingCVE-2025-69203 · GHSA-VFRF-VCJ7-WVR8 signalk-server npm Medium Fix reported