SecAlerts
S

Signal

Security Risk Profile

35
/100
low

Security Risk Score

Comprehensive risk assessment based on 26 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 10, 2018 to present

26
Total CVEs
7
Critical+High
4
Exploited
5
Unpatched

Threat Assessment

Avg CVSS
6.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
5
Critical/High
Risk Level
35/100
low
⚠️ 4 Active Exploits 2 Zero-Days🆕 3Fresh (<7d)📈 3 in Last 30 Days

Severity Distribution

Critical
1
High
6
Medium
8
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
Infoleak
3
2
XSS
2

Most Affected Products

1. Signal Signal-Desktop18
2. Signal Signal7
3. Signal Private Messenger Android5
4. Signal Signal Iphone Os4
5. Meta WhatsApp3

Recent Vulnerabilities

See more →
GHSL-2026-112
unknown

_GHSL-2026-113: Cross-thread authorization flaws allow unauthorized pin changes and poll votes in Signal for iOS

Sep 21, 2026🔧 No Patch
GHSL-2026-113
unknown

GHSL-2026-112_GHSL-2026-113: Cross-thread authorization flaws allow unauthorized pin changes and poll votes in Signal for iOS

Sep 21, 2026🔧 No Patch
GHSL-2026-105
unknown

Removed Signal group members can modify previously sent messages on a recipient’s iOS device

Sep 21, 2026🔧 No Patch
https://www.bleepingcomputer.com/news/security/android-spyware-campaigns-impersonate-signal-and-totok-messengers/
unknown

Android spyware campaigns impersonate Signal and ToTok messengers

Oct 2, 2025⚠ Exploited🔧 No Patch
CVE-2025-5715
CVSS 6.4EPSS 0%medium

Signal App Biometric Authentication missing critical step in authentication

Jun 6, 2025🔧 No Patch
https://www.zdnet.com/article/rebooting-your-phone-daily-is-your-best-defense-against-zero-click-attacks-heres-why/
unknown

Rebooting your phone daily is your best defense against zero-click attacks - here's why

May 14, 2025⚠ Exploited⚡ Zero-Day🔧 No Patch
https://www.zdnet.com/article/5-ways-to-avoid-spyware-disguised-as-legit-apps-before-its-too-late/
unknown

5 ways to avoid spyware disguised as legit apps - before it's too late

Apr 9, 2025🔧 No Patch
https://www.bleepingcomputer.com/news/security/russian-phishing-campaigns-exploit-signals-device-linking-feature/
unknown

Russian phishing campaigns exploit Signal's device-linking feature

Feb 19, 2025⚠ Exploited🔧 No Patch
CVE-2025-24904
CVSS 8.5EPSS 0%high
Feb 13, 2025🔧 No Patch
https://www.darkreading.com/threat-intelligence/cloudflare-cdn-bug-outs-user-locations-signal-discord
unknown

Cloudflare CDN Bug Outs User Locations on Signal, Discord

Jan 23, 2025⚠ Exploited🔧 No Patch

Monitor Signal in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.