CVE-2026-46404 | Medium | 6.8 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link loc… |
CVE-2026-46353 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl paramete… |
CVE-2026-46351 | High | 8.1 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in b… |
CVE-2026-27737 | Medium | 6.5 | 2026-05-18 | BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in… |
CVE-2026-41127 | Medium | 6.5 | 2026-04-22 | BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Versi… |
CVE-2026-41126 | Medium | 4.3 | 2026-04-22 | BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL."… |
CVE-2026-27736 | Medium | 6.1 | 2026-02-25 | BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, u… |
CVE-2026-27467 | Low | 2.0 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio… |
CVE-2026-27466 | High | 7.2 | 2026-02-21 | BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as… |
CVE-2025-61602 | High | 7.5 | 2025-10-09 | BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash t… |
CVE-2025-61601 | High | 7.5 | 2025-10-09 | BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze… |
CVE-2025-55200 | High | 7.1 | 2025-10-09 | BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnera… |
CVE-2024-39302 | Low | 3.7 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated fi… |
CVE-2024-38518 | Medium | 4.6 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick… |
CVE-2022-36029 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-36028 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2023-43798 | Medium | 5.6 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). T… |
CVE-2023-43797 | Medium | 6.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wai… |
CVE-2023-42804 | Low | 3.1 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with… |
CVE-2023-42803 | Medium | 5.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocum… |
CVE-2023-33176 | Medium | 4.8 | 2023-06-26 | BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Reques… |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2022-23490 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetin… |
CVE-2022-41964 | Medium | 5.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subs… |
CVE-2022-41963 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but… |
CVE-2022-41962 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41960 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in D… |
CVE-2020-27602 | Critical | 9.8 | 2022-09-29 | BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken. |
CVE-2020-27601 | Low | 3.5 | 2022-09-29 | In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/compo… |
CVE-2022-31065 | Medium | 6.5 | 2022-06-27 | BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the… |
CVE-2022-31064 | Medium | 6.5 | 2022-06-27 | BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affecte… |
CVE-2022-31039 | Medium | 4.3 | 2022-06-27 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are no… |
CVE-2022-27238 | Medium | 5.4 | 2022-06-24 | BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject Java… |
CVE-2022-26497 | Medium | 5.4 | 2022-06-02 | BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of t… |
CVE-2022-29236 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access r… |
CVE-2022-29235 | Medium | 5.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain t… |
CVE-2022-29234 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a l… |
CVE-2022-29233 | Medium | 4.3 | 2022-06-02 | BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access c… |
CVE-2022-29232 | Medium | 6.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent acces… |
CVE-2022-29169 | High | 7.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expr… |
CVE-2021-4143 | Medium | 6.1 | 2022-01-19 | Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0. |
CVE-2020-29043 | High | 7.5 | 2020-11-26 | An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an ap… |
CVE-2020-29042 | Low | 3.7 | 2020-11-26 | An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that… |
CVE-2020-28954 | Medium | 5.3 | 2020-11-19 | web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a… |
CVE-2020-28953 | Medium | 4.3 | 2020-11-19 | In BigBlueButton before 2.2.29, a user can vote more than once in a single poll. |
CVE-2020-27642 | Medium | 6.1 | 2020-10-22 | A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6. |
CVE-2020-27613 | High | 8.4 | 2020-10-21 | The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended… |
CVE-2020-27612 | Medium | 4.3 | 2020-10-21 | Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an informat… |
CVE-2020-27611 | High | 7.3 | 2020-10-21 | BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint. |
CVE-2020-27610 | High | 7.5 | 2020-10-21 | The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set… |
CVE-2020-27609 | Medium | 5.3 | 2020-10-21 | BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond… |
CVE-2020-27608 | Medium | 6.1 | 2020-10-21 | In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a… |
CVE-2020-27607 | Medium | 6.5 | 2020-10-21 | In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It do… |
CVE-2020-27606 | Medium | 5.3 | 2020-10-21 | BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to… |
CVE-2020-27605 | Critical | 9.8 | 2020-10-21 | BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandb… |
CVE-2020-27604 | Medium | 6.5 | 2020-10-21 | BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in t… |
CVE-2020-27603 | High | 7.5 | 2020-10-21 | BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files. |
CVE-2020-25820 | Medium | 6.5 | 2020-10-21 | BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted UR… |
CVE-2020-26163 | High | 8.8 | 2020-09-30 | BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password… |
CVE-2020-12443 | Critical | 9.8 | 2020-04-29 | BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFile… |
CVE-2020-12113 | Medium | 6.1 | 2020-04-23 | BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. |
CVE-2020-12112 | High | 7.5 | 2020-04-23 | BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. |