Known vulnerabilities in BigBlueButton

Software: BigBlueButton
Software CPE: cpe:2.3:a:blindsidenetworks:bigbluebutton:*:*:*:*:*:wordpress:*:*
Total vulnerabilities: 43
Public exploits: 3
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting BigBlueButton BigBlueButton is affected by 43 known vulnerabilities: 24 medium, 19 low Critical High Medium Low

Vulnerabilities (43)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150174 - Missing Authorization
CWE-862 Medium
No
No
3.0.37 16.09.2026 SB2026091624
#VU150173 - Incorrect Authorization
CWE-863 Medium
No
No
3.0.37, 4.0.0 rc.2 16.09.2026 SB2026091624
#VU150172 - Incorrect Authorization
CWE-863 Medium
No
No
3.0.37, 4.0.0 rc.2 16.09.2026 SB2026091624
#VU150171 - Improper Handling of Extra Parameters
CWE-235 Medium
No
No
3.0.37, 4.0.0 rc.2 16.09.2026 SB2026091624
#VU150170 - Improper Access Control
CWE-284 Medium
No
No
3.0.37, 4.0.0 rc.2 16.09.2026 SB2026091624
#VU143926 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
3.0.35, 4.0.0 beta.5 18.08.2026 SB2026081817
#VU133355 - Improper Authentication
CVE-2026-46355
CWE-287 Medium
No
No
3.0.23 04.06.2026 SB2026060454
#VU133354 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-46682
CWE-89 Medium
No
No
3.0.23 04.06.2026 SB2026060454
#VU125913 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-41126
CWE-601 Low
No
No
3.0.24 14.04.2026 SB2026041454
#VU125912 - Authorization Bypass Through User-Controlled Key
CVE-2026-41127
CWE-639 Low
No
No
3.0.24 14.04.2026 SB2026041454
#VU125909 - Incorrect Permission Assignment for Critical Resource
CVE-2024-39302
CWE-732 Low
No
No
2.7.8 27.06.2024 SB2024062768
#VU125910 - Improper Access Control
CVE-2024-38518
CWE-284 Low
No
No
2.7.8 27.06.2024 SB2024062768
#VU125908 - Server-Side Request Forgery (SSRF)
CVE-2023-33176
CWE-918 Medium
No
No
2.5.18, 2.6.9 26.06.2023 SB2023062657
#VU131444 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-31064
CWE-79 Medium
No
No
2.4.8, 2.5.0 22.06.2022 SB2022060245
#VU131445 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-31065
CWE-79 Low
No
No
2.4.8, 2.5.0 22.06.2022 SB2022060245
#VU131446 - Resource exhaustion
CVE-2022-29169
CWE-400 Medium
No
No
2.3.19, 2.4.7, 2.5.0 02.06.2022 SB2022060245
#VU131759 - Improper Access Control
CVE-2022-29232
CWE-284 Low
No
No
2.3.9 02.06.2022 SB2022060246
#VU131447 - Improper Access Control
CVE-2022-29236
CWE-284 Low
No
No
2.3.18, 2.4 rc-6 02.06.2022 SB2022060143
#VU131449 - Improper Access Control
CVE-2022-29234
CWE-284 Low
No
No
2.3.18, 2.4.1 01.06.2022 SB2022060143
#VU131448 - Improper Access Control
CVE-2022-29235
CWE-284 Medium
No
No
2.3.18, 2.4 rc-6 01.06.2022 SB2022060143


Showing elements 1 - 20 out of 43