Login Request a demo
AS
Product
asterisk
by asterisk · last CVE Oct 27, 2026
45
CVEs
0
On KEV
8.8
Max CVSS
20
New 30D
Vulnerabilities45In the news0Timeline
Severity mix
Critical 0High 13Medium 9Low 4
Severity
All severities45Critical0High13Medium9Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add asterisk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-57203
New
6.9–Oct 27
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57193
New
6.9
2%
Oct 26
Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57185
New
6.5–Oct 27
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-23739
6.5
0%
Feb 6
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9
CVE-2026-57184
New
6.3
1%
Oct 26
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-23738
6.1
0%
Feb 6
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9
CVE-2026-57192
New
6.0–Oct 27
Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57194
New
5.9–Oct 27
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2024-42491
5.7
1%
Sep 5
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Affected: < 18.24.3; >= 19.0.0, < 20.9.3; >= 21.0.0, < 21.4.3; < 18.9-cert12; >= 19.0, < 20.7-cert2
Showing 9