These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-41893 affects Signal K Server versions before 2.25.0. The HTTP login endpoints are rate-limited, but the WebSocket login path accepts username/password messages without the same protection, allowing repeated guessing at the pace of bcrypt verification. The issue was addressed in version 2.25.0.
CVE-2026-35038 is an arbitrary prototype read vulnerability in Signal K Server before version 2.24.0. A low-privileged authenticated user can bypass prototype boundary filtering to extract internal functions and properties from the global prototype object, violating data isolation. This issue allows attackers to access more information than they should, potentially leading to further exploitation. Users o [truncated]