| Signal K Server: Buffered logs exposed to unauthenticated WebSocket clientsGHSA-7M8X-X364-M26J |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionCVE-2026-123807 · GHSA-4XM8-RG9H-JHQ2 |
@signalk/resources-providersignalk-server |
npm |
بحرانی
|
اصلاح گزارش شده |
|
| signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherCVE-2026-115752 · GHSA-7WPF-CH8F-5F4X |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server: Server-Side Request Forgery via Remote Connection EndpointsCVE-2026-55591 · GHSA-Q59X-JC9F-GFQF |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)CVE-2026-41893 · GHSA-VMFM-CH9H-5C7G |
signalk-server |
npm |
زیاد
|
اصلاح گزارش شده |
|
| Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingCVE-2025-68272 · GHSA-7RQC-FF8M-7J23 |
signalk-server |
npm |
زیاد
|
اصلاح گزارش شده |
|
| Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsCVE-2025-68273 · GHSA-FPF5-W967-RR2M |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)CVE-2025-66398 · GHSA-W3X5-7C4C-66P9 |
signalk-server |
npm |
بحرانی
|
اصلاح گزارش شده |
|
| Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription PathsCVE-2026-39320 · GHSA-7GCJ-PHFF-2884 |
signalk-server |
npm |
زیاد
|
اصلاح گزارش شده |
|
| Signal K Server: Unauthenticated Source Priorities Manipulation CVE-2026-33951 · GHSA-GFMV-VH34-H2X5 |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowCVE-2026-34083 · GHSA-CXJ8-GGF2-P57C |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-33950 · GHSA-X8HC-FQV3-7GWF |
signalk-server |
npm |
بحرانی
|
اصلاح گزارش شده |
|
| Signal K Server: Arbitrary Prototype Read via `from` Field BypassCVE-2026-35038 · GHSA-QH3J-MRG8-F234 |
signalk-server |
npm |
کم
|
اصلاح گزارش شده |
|
| SignalK Server has Path Traversal leading to information disclosureCVE-2026-25228 · GHSA-VRHW-V2HW-JFFX |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
| Signal K Server Vulnerable to Remote Code Execution via Malicious npm PackageCVE-2025-68619 · GHSA-93JC-VQQC-VVVH |
signalk-server |
npm |
زیاد
|
اصلاح گزارش شده |
|
| Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated PollingCVE-2025-68620 · GHSA-FQ56-HVG6-WVM5 |
signalk-server |
npm |
بحرانی
|
اصلاح گزارش شده |
|
| Signal K Server Vulnerable to Access Request SpoofingCVE-2025-69203 · GHSA-VFRF-VCJ7-WVR8 |
signalk-server |
npm |
متوسط
|
اصلاح گزارش شده |
|
