SignalK has 9 CVEs on record. 2 were published in the last 90 days. The busiest recent month was January 2026 with 6. The median CVSS is 6.5 (medium), with 2 rated critical. None have a confirmed exploitation report. Most affected products: signal_k_server (7), signalk-server (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Products
- signal_k_server 7
- signalk-server 2
Worst active — by depth score
CVE-2025-66398Critical· 9.6Signal K Server is a server application that runs on a central hub in a boat69CVE-2025-68620Critical· 9.1Signal K Server is a server application that runs on a central hub in a boat50CVE-2026-55591Medium· 5.8Signal K Server is a server application that runs on a central hub in a boat44CVE-2025-68273Medium· 5.3Signal K Server is a server application that runs on a central hub in a boat41CVE-2025-68272High· 7.5Signal K Server is a server application that runs on a central hub in a boat41
SignalK vulnerabilities
CVEs affecting SignalK, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-115752Medium· 4.2Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can m…
CVE-2026-55591Medium· 5.8PoCSignal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalK…
CVE-2026-35038Medium· 6.5Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated u…
CVE-2025-69203Medium· 6.3Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerabili…
CVE-2025-68620Critical· 9.1Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combi…
CVE-2025-68619High· 7.2Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that …
CVE-2025-68273Medium· 5.3PoCSignal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the ful…
CVE-2025-68272High· 7.5Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access reque…
CVE-2025-66398Critical· 9.6PoCSignal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoi…