SecAlerts
Signal logo

Signal

Security Risk Profile

44
/100
medium

Security Risk Score

Comprehensive risk assessment based on 23 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from April 10, 2018 to present

23
Total CVEs
7
Critical+High
4
Exploited
5
Unpatched

Threat Assessment

Avg CVSS
6.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
5
Critical/High
Risk Level
44/100
medium
⚠️ 4 Active Exploits 2 Zero-Days

Severity Distribution

Critical
1
High
6
Medium
8
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
2

Age Distribution

Common Weaknesses (CWE)

1
Infoleak
3
2
XSS
2

Most Affected Products

1. Signal Signal-Desktop18
2. Signal Signal7
3. Signal Private Messenger Android5
4. Signal Signal Iphone Os4
5. Meta WhatsApp3

Recent Vulnerabilities

See more →
https://www.bleepingcomputer.com/news/security/android-spyware-campaigns-impersonate-signal-and-totok-messengers/
unknown

Android spyware campaigns impersonate Signal and ToTok messengers

10/2/2025⚠ Exploited🔧 No Patch
CVE-2025-5715
CVSS 6.4EPSS 0%medium

Signal App Biometric Authentication missing critical step in authentication

6/6/2025🔧 No Patch
https://www.zdnet.com/article/rebooting-your-phone-daily-is-your-best-defense-against-zero-click-attacks-heres-why/
unknown

Rebooting your phone daily is your best defense against zero-click attacks - here's why

5/14/2025⚠ Exploited⚡ Zero-Day🔧 No Patch
https://www.zdnet.com/article/5-ways-to-avoid-spyware-disguised-as-legit-apps-before-its-too-late/
unknown

5 ways to avoid spyware disguised as legit apps - before it's too late

4/9/2025🔧 No Patch
https://www.bleepingcomputer.com/news/security/russian-phishing-campaigns-exploit-signals-device-linking-feature/
unknown

Russian phishing campaigns exploit Signal's device-linking feature

2/19/2025⚠ Exploited🔧 No Patch
CVE-2025-24904
CVSS 8.5EPSS 0%high
2/13/2025🔧 No Patch
https://www.darkreading.com/threat-intelligence/cloudflare-cdn-bug-outs-user-locations-signal-discord
unknown

Cloudflare CDN Bug Outs User Locations on Signal, Discord

1/23/2025⚠ Exploited🔧 No Patch
https://www.bleepingcomputer.com/news/security/cloudflare-cdn-flaw-leaks-user-location-data-even-through-secure-chat-apps/
unknown

Cloudflare CDN flaw leaks user location data, even through secure chat apps

1/22/2025⚡ Zero-Day🔧 No Patch
https://www.bleepingcomputer.com/news/security/french-government-recommends-against-using-foreign-chat-apps/
unknown

French government recommends against using foreign chat apps

12/1/2023🔧 No Patch
CVE-2023-24068
CVSS 7.8high
1/23/2023🔧 No Patch

Monitor Signal in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

Signal Security Vulnerabilities & Risk Score | 23 CVEs | SecAlerts - SecAlerts