signalk signalk-server vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 9.8CVE-2026-123807EPSS 0.5%2026-11-09

   Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resource…

2. 9.3CVE-2026-118690EPSS 0.7%2026-10-28

   Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.j…

3. 2.3CVE-2026-115752EPSS 0.2%2026-10-23

   Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can mak…

4. 5.8CVE-2026-55591EPSS 0.3%2026-09-15

   Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKCo…