npm/signalk-server

Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

Modified: 4/21/2026

Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Modified: 2/3/2026

Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

Modified: 2/3/2026

Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

Modified: 4/3/2026

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

Modified: 2/3/2026

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Modified: 2/3/2026

Signal K Server: Unauthenticated Source Priorities Manipulation

Modified: 4/6/2026

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Modified: 6/18/2026

Signal K Server: Arbitrary Prototype Read via `from` Field Bypass

Modified: 4/3/2026

Signal K Server Vulnerable to Access Request Spoofing

Modified: 2/3/2026

Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Modified: 5/13/2026

SignalK Server has Path Traversal leading to information disclosure

Modified: 2/3/2026

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Modified: 2/3/2026

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Modified: 4/3/2026