CVE-2026-35038Medium· 6.5▾ SunlitSignal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated u…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via from field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.
signal_k_server < 2.24.0Upgrade past the affected range:
signal_k_server 2.24.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68273Medium· 5.3Signal K Server is a server application that runs on a central hub in a boat
CVE-2025-68620Critical· 9.1Signal K Server is a server application that runs on a central hub in a boat
CVE-2025-69203Medium· 6.3Signal K Server is a server application that runs on a central hub in a boat
CVE-2025-68619High· 7.2Signal K Server is a server application that runs on a central hub in a boat
CVE-2025-66398Critical· 9.6Signal K Server is a server application that runs on a central hub in a boat
CVE-2025-68272High· 7.5Signal K Server is a server application that runs on a central hub in a boat