CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

PT-2026-27686

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19.0-08368-gfafda3b4b06b 22 Description The Linux kernel contains a flaw related to MPTCP Multipath TCP path management. A specific sequence of actions, involving setting the MPTCP subflows limit to zero,...

Signal K Server 安全漏洞

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that originates from an unauthenticated attacker who can cause the server to crash by accessing a request endpoint flooding attack, potentially...

Signal K Server 安全漏洞

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that originates from an unauthenticated attacker who can contaminate the internal state of the server, potentially leading to account takeover and...

Signal K Server 安全漏洞

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that stems from unauthenticated WebSocket request enumeration and token polling functionality that can be exploited by links, potentially leading to ...

PT-2026-6172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the arm64/fpsimd component related to the restoration of SVE context when SME is supported. Restoring SVE signal context can lead to an invalid state,...

PT-2026-1015

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server, a server application used on boats, is susceptible to an issue where an unauthenticated attacker can manipulate the server's internal state. This manipulation occurs through...

PT-2026-1025

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. Versions prior to 2.19.0 contain issues in the access request system that, when combined, can be used in social engineering attacks...

Signal K Server 安全漏洞

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that stems from the access request system trusting the X-Forwarded-For header and inconsistently displaying the description field with the permission...

Signal K Server 代码注入漏洞

Signal K Server is a ship centralized server for Signal K open source. A code injection vulnerability exists in Signal K Server versions prior to 2.19.0, which stems from the appstore interface passing version parameters directly to npm without cleaning them up, which could lead to arbitrary code...

Signal K Server 信息泄露漏洞

Signal K Server is a ship centralized server from Signal K open source. An information disclosure vulnerability exists in versions of Signal K Server prior to 2.19.0 that originates from an unauthenticated information disclosure that allows any user to retrieve sensitive system information,...

PT-2026-1016

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. A Denial of Service DoS condition can occur in versions prior to 2.19.0. An unauthenticated attacker can crash the server by sending a...

PT-2026-1022

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server, a server application used on boats, has an information disclosure issue. An unauthenticated user can access sensitive system information. This includes the complete SignalK...

PT-2026-1024

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. Versions prior to 2.19.0 contain issues that allow attackers to steal JWT authentication tokens without prior authentication. This is...

PT-2026-1023

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used in marine environments. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API...

SUSE CVE-2023-54235

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix destroyworkonstack race The following debug object splat was observed in testing: ODEBUG: free active active state 0 object: 0000000097d23782 object type: workstruct hint: doestatemachinework+0x0/0x510 WARNING: CPU: ...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993095 advisory. In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDNdspelementregister Afer commit 1fa5ae857bb1 driver core:...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992971 advisory. In the Linux kernel, the following vulnerability has been resolved: nbd: Fix hung when signal interrupts nbdstartdeviceioctl syzbot reported hung task 1. The followi...