100 matches found
Exploit for CVE-2026-123807
signalk-audit A tool for auditing and creating a proof-of-con...
CVE-2026-123807
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
CVE-2026-123807
The Signal K Server (v2.0.0–2.33.9) and @signalk/resources-provider (v1.0.0–1.5.2) are vulnerable to a path traversal flaw in the v2 REST resources API. The GET /signalk/v2/api/resources/:resourceType/:resourceId route fails to validate the resourceId parameter, allowing attackers to escape the i...
CVE-2026-123807
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
CVE-2026-123807 Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
CVE-2026-123807 Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
CVE-2026-123807 Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
EUVD-2026-120438
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
CVE-2026-123807: SignalK, @signalk: Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...
GHSA-7WPF-CH8F-5F4X signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...
npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
npm: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher vulnerability discovered by ? in WordPress npm signalk-server versions = 2.28.0-beta.2, 2.34.0...
npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
npm: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution vulnerability discovered by ? in WordPress npm signalk-server versions = 2.0.0, 2.34.0...
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-55591 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-55591 Source advisory: MEND:CVE-2026-55591...
Server-side Request Forgery (SSRF)
Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the makeRemoteRequest function. An attacker can access internal network resources, cloud metadata services, and arbitrary extern...
PT-2026-50825
Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...
CVE-2026-55591
creationtimestamp| type| source ---|---|--- 2026-06-16 18:01:53+00:00| published-proof-of-concept| https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf...
current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-41893 via signalk-server (1.46.3)
signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-41893 Source advisory: MEND:CVE-2026-41893...
CVE-2026-41893
Signal K Server’s WebSocket login path (via ws signalk/v1/stream) processes login attempts without rate limiting, enabling credential brute‑forcing at ~20 attempts/sec per WebSocket connection and bypassing HTTP rate limiting. Affected cve: CVE-2026-41893 concerns pre‑2.25.0 behavior. Technical d...
PT-2026-37162
Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.25.0 Description The WebSocket login path, which involves sending login: username, password messages over an established connection, calls the app.securityStrategy.login function directly without rate...