# bigbluebutton.

Every CVE that names bigbluebutton among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass](https://agentprime.io/advisories/CVE-2026-55489.md)
  `CVE-2026-55489` · CVE record: bigbluebutton bigbluebutton · CVSS 4.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control
- [BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name](https://agentprime.io/advisories/CVE-2026-55491.md)
  `CVE-2026-55491` · CVE record: bigbluebutton bigbluebutton · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS)
- [BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser](https://agentprime.io/advisories/CVE-2026-46355.md)
  `CVE-2026-46355` · CVE record: bigbluebutton bigbluebutton · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Authentication bypass
- [BigBlueButton: Blind SQL Injection AUTH (Moderator)](https://agentprime.io/advisories/CVE-2026-46682.md)
  `CVE-2026-46682` · CVE record: bigbluebutton bigbluebutton · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: SQL injection
- [BigBlueButton API checksum bypass via presentationUploadExternalUrl](https://agentprime.io/advisories/CVE-2026-46353.md)
  `CVE-2026-46353` · CVE record: bigbluebutton bigbluebutton · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [BigBlueButton: Presentation URL Security Hardening](https://agentprime.io/advisories/CVE-2026-46404.md)
  `CVE-2026-46404` · CVE record: bigbluebutton bigbluebutton · CVSS 6.8 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them](https://agentprime.io/advisories/CVE-2026-46351.md)
  `CVE-2026-46351` · CVE record: bigbluebutton bigbluebutton · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Weak cryptography or TLS
- [BigBlueButton has Stored XSS in bbb-playback replay](https://agentprime.io/advisories/CVE-2026-27737.md)
  `CVE-2026-27737` · CVE record: bigbluebutton bigbluebutton and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 18 May 2026 · Tags: Cross-site scripting (XSS)
- [BigBlueButton's missing authorization allows viewer to inject/overwrite captions](https://agentprime.io/advisories/CVE-2026-41127.md)
  `CVE-2026-41127` · CVE record: bigbluebutton bigbluebutton · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control
- [BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"](https://agentprime.io/advisories/CVE-2026-41126.md)
  `CVE-2026-41126` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Open redirect
- [BigBlueButton has Open Redirect vulnerability in ApiController](https://agentprime.io/advisories/CVE-2026-27736.md)
  `CVE-2026-27736` · CVE record: bigbluebutton bigbluebutton · CVSS 6.1 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Open redirect
- [BigBlueButton: Audio from participants to the server initially unmuted](https://agentprime.io/advisories/CVE-2026-27467.md)
  `CVE-2026-27467` · CVE record: bigbluebutton bigbluebutton · CVSS 2.0 Low · Not analysed yet · Published 21 Feb 2026 · Tags: Information disclosure
- [BigBlueButton: Exposed ClamAV port enables Denial of Service](https://agentprime.io/advisories/CVE-2026-27466.md)
  `CVE-2026-27466` · CVE record: bigbluebutton bigbluebutton · CVSS 7.2 High · Not analysed yet · Published 21 Feb 2026 · Tags: Information disclosure
- [BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId](https://agentprime.io/advisories/CVE-2025-61602.md)
  `CVE-2025-61602` · CVE record: bigbluebutton bigbluebutton · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-703
- [BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation](https://agentprime.io/advisories/CVE-2025-61601.md)
  `CVE-2025-61601` · CVE record: bigbluebutton bigbluebutton · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-703
- [BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes](https://agentprime.io/advisories/CVE-2025-55200.md)
  `CVE-2025-55200` · CVE record: bigbluebutton bigbluebutton · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Some bbb-record-core files installed with wrong file permission](https://agentprime.io/advisories/CVE-2024-39302.md)
  `CVE-2024-39302` · CVE record: bigbluebutton bigbluebutton · CVSS 3.7 Low · Not analysed yet · Published 28 Jun 2024 · Tags: Privilege escalation
- [bbb-web API additional parameters considered](https://agentprime.io/advisories/CVE-2024-38518.md)
  `CVE-2024-38518` · CVE record: bigbluebutton bigbluebutton · CVSS 4.6 Medium · Not analysed yet · Published 28 Jun 2024 · Tags: Broken access control
- [BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)](https://agentprime.io/advisories/CVE-2023-43798.md)
  `CVE-2023-43798` · CVE record: bigbluebutton bigbluebutton · CVSS 5.6 Medium · Not analysed yet · Published 30 Oct 2023 · Tags: Server-side request forgery (SSRF)
- [BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby](https://agentprime.io/advisories/CVE-2023-43797.md)
  `CVE-2023-43797` · CVE record: bigbluebutton bigbluebutton · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2023 · Tags: Cross-site scripting (XSS)
- [BigBlueButton Path Traversal – Reading Certain File Extensions](https://agentprime.io/advisories/CVE-2023-42804.md)
  `CVE-2023-42804` · CVE record: bigbluebutton bigbluebutton · CVSS 3.1 Low · Not analysed yet · Published 30 Oct 2023 · Tags: Path traversal
- [BigBlueButton Unrestricted File Upload vulnerability](https://agentprime.io/advisories/CVE-2023-42803.md)
  `CVE-2023-42803` · CVE record: bigbluebutton bigbluebutton · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2023 · Tags: Unrestricted file upload
- [Blind SSRF When Uploading Presentation in BigBlueButton](https://agentprime.io/advisories/CVE-2023-33176.md)
  `CVE-2023-33176` · CVE record: bigbluebutton bigbluebutton · CVSS 4.8 Medium · Not analysed yet · Published 26 Jun 2023 · Tags: Server-side request forgery (SSRF)
- [BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data](https://agentprime.io/advisories/CVE-2022-23488.md)
  `CVE-2022-23488` · CVE record: bigbluebutton bigbluebutton · CVSS 6.5 Medium · Not analysed yet · Published 17 Dec 2022 · Tags: Information disclosure
- [Improper access control to polling votes](https://agentprime.io/advisories/CVE-2022-23490.md)
  `CVE-2022-23490` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 16 Dec 2022 · Tags: Information disclosure, Broken access control
- [BigBlueButton contains Response leaks in anonymous polls](https://agentprime.io/advisories/CVE-2022-41964.md)
  `CVE-2022-41964` · CVE record: bigbluebutton bigbluebutton · CVSS 5.7 Medium · Not analysed yet · Published 16 Dec 2022 · Tags: Information disclosure
- [BigBlueButton contains Improper Preservation of Permissions for whiteboard](https://agentprime.io/advisories/CVE-2022-41963.md)
  `CVE-2022-41963` · CVE record: bigbluebutton bigbluebutton · CVSS 2.7 Low · Not analysed yet · Published 16 Dec 2022 · Tags: CWE-281
- [BigBlueButton contains Incorrect Authorization for setting emoji status](https://agentprime.io/advisories/CVE-2022-41962.md)
  `CVE-2022-41962` · CVE record: bigbluebutton bigbluebutton · CVSS 2.7 Low · Not analysed yet · Published 16 Dec 2022 · Tags: Broken access control
- [BigBlueButton subject to Ineffective user bans](https://agentprime.io/advisories/CVE-2022-41961.md)
  `CVE-2022-41961` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 16 Dec 2022 · Tags: CWE-345, CWE-346
- [BigBlueButton contains DoS via failed authToken validation](https://agentprime.io/advisories/CVE-2022-41960.md)
  `CVE-2022-41960` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2022 · Tags: CWE-345
- [Cross site scripting in username that will trigger by sending chat](https://agentprime.io/advisories/CVE-2022-31064.md)
  `CVE-2022-31064` · CVE record: bigbluebutton bigbluebutton · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Cross site scripting vulnerability for private chat in bigbluebutton](https://agentprime.io/advisories/CVE-2022-31065.md)
  `CVE-2022-31065` · CVE record: bigbluebutton bigbluebutton · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Limited data exposure for shared external videos in BigBlueButton](https://agentprime.io/advisories/CVE-2022-29235.md)
  `CVE-2022-29235` · CVE record: bigbluebutton bigbluebutton · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Information disclosure
- [Improper access control for pencil annotations in BigBlueButton](https://agentprime.io/advisories/CVE-2022-29236.md)
  `CVE-2022-29236` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Broken access control
- [Grace period for lock settings in public/private chats in BigBlueButton](https://agentprime.io/advisories/CVE-2022-29234.md)
  `CVE-2022-29234` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Broken access control
- [Improper access control for breakout rooms in BigBlue Button](https://agentprime.io/advisories/CVE-2022-29233.md)
  `CVE-2022-29233` · CVE record: bigbluebutton bigbluebutton · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Broken access control
- [Exposure of messages in BigBlueButton public chats](https://agentprime.io/advisories/CVE-2022-29232.md)
  `CVE-2022-29232` · CVE record: bigbluebutton bigbluebutton · CVSS 6.5 Medium · Not analysed yet · Published 1 Jun 2022 · Tags: Information disclosure
- [ReDoS on endpoint html5client/useragent in BigBlueButton](https://agentprime.io/advisories/CVE-2022-29169.md)
  `CVE-2022-29169` · CVE record: bigbluebutton bigbluebutton · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2022 · Tags: CWE-20

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=bigbluebutton>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/bigbluebutton/>. Everything for agents: <https://agentprime.io/llms.txt>.