Login Request a demo
AS
Product
Asterisk
by Sangoma · last CVE Feb 6, 2026
28
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities28In the news0Timeline
Severity mix
Critical 4High 8Medium 13Low 0
Severity
All severities28Critical4High8Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Asterisk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-23739
6.5
0%
Feb 6
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
Affected: before 20.18.2; 21.0.0 before 21.12.1; 22.0.0 before 22.8.2; 23.0.0 before 23.2.2
CVE-2025-54995
6.5
0%
Aug 28
Asterisk is an open source private branch exchange and telephony toolkit
Affected: before 18.26.4
CVE-2025-49832
6.5
0%
Aug 1
Asterisk is an open source private branch exchange and telephony toolkit
Affected: before 18.26.3; 20.0.0 before 20.15.1; 21.0.0 before 21.10.1; 22.0.0 before 22.5.1
CVE-2025-47779
6.5
1%
May 22
Asterisk is an open-source private branch exchange (PBX)
Affected: before 18.26.2; 20.0.0 before 20.14.1; 21.0.0 before 21.9.1; 22.0.0 before 22.4.1
CVE-2022-42705
6.5
1%
Dec 5
A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of…
Affected: 16.0.0 before 16.29.1; 18.14.0 before 18.15.1; 19.6.0 before 19.7.1; 20.0.0
CVE-2020-28242
6.5
2%
Nov 6
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5
Affected: 13.0 before 13.37.1; 16.0 before 16.14.1; 17.0 before 17.8.1; 18.0 before 18.0.1
CVE-2018-12228
6.5
6%
Jun 12
An issue was discovered in Asterisk Open Source 15.x before 15.4.1
Affected: 15.0 before 15.4.1
CVE-2026-23738
6.1
0%
Feb 6
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Affected: through 20.18.2; 21.0.0 through 21.12.1; 22.0.0 through 22.8.2; 23.0.0 before 23.2.2
CVE-2024-42491
5.7
1%
Sep 5
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Affected: before 18.24.3; 20.0.0 before 20.9.3; 21.0.0 through 21.4.3
CVE-2024-53566
5.5
0%
Dec 2
An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal
Affected: 22.0.0; 22.0.0; 22.0.0; 22.0.0
CVE-2024-35190
5.3
1%
May 17
Asterisk is an open source private branch exchange and telephony toolkit
Affected: 18.23.0; 20.8.0; 21.3.0
CVE-2020-28327
5.3
2%
Nov 6
A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1
Affected: 13.0.0 before 13.37.1; 16.0.0 before 16.14.1; 17.0.0 before 17.8.1; 18.0.0 before 18.0.1
CVE-2022-42706
4.9
1%
Dec 5
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1
Affected: 16.0.0 before 16.29.1; 17.0.0 before 18.15.1; 19.0.0 before 19.7.1; 20.0.0
Showing 13