Skip to content
OpenAdvisories

Package · npm

signalk-server

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-115752

    Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

    Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request lo…

    SignalK signalk-server signalk-server npm
  • Medium 5.8
    CVE-2026-55591

    Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

    Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAcc…

    SignalK signalk-server signalk-server npm
  • Medium 6.1
    CVE-2026-34083

    signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAu…

    SignalK signalk-server signalk-server npm
  • Medium 6.9
    CVE-2026-33951

    signalk-server: Unauthenticated Source Priorities Manipulation

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, …

    SignalK signalk-server signalk-server npm
  • Medium 5.0
    CVE-2026-25228

    SignalK Server has Path Traversal leading to information disclosure

    Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and di…

    SignalK signalk-server signalk-server npm
  • Medium 6.3
    CVE-2025-69203

    Signal K Server Vulnerable to Access Request Spoofing

    Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing s…

    SignalK signalk-server signalk-server npm
  • Medium 5.3
    CVE-2025-68273 Scanner template

    Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

    Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema,…

    SignalK signalk-server signalk-server npm