CA
Product
Certified Asterisk
15
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 9Low 0
Watch
Add Certified Asterisk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23741 | 8.8 | Feb 6 | ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +5 more |
| CVE-2023-37457 | 8.2 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +22 more |
| CVE-2026-23740 | 7.8 | Feb 6 | Asterisk vulnerable to potential privilege escalation Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +34 more |
| CVE-2025-1131 | 7.8 | Sep 23 | A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package Affected: 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +20 more |
| CVE-2025-47780 | 7.8 | May 22 | Asterisk is an open-source private branch exchange (PBX) Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +18 more |
| CVE-2023-49294 | 7.5 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +22 more |
| CVE-2026-23739 | 6.5 | Feb 6 | Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +5 more |
| CVE-2025-54995 | 6.5 | Aug 28 | Asterisk is an open source private branch exchange and telephony toolkit Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +14 more |
| CVE-2025-49832 | 6.5 | Aug 1 | Asterisk is an open source private branch exchange and telephony toolkit Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +3 more |
| CVE-2025-47779 | 6.5 | May 22 | Asterisk is an open-source private branch exchange (PBX) Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +18 more |
| CVE-2022-42705 | 6.5 | Dec 5 | A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of… Affected: 18.9 |
| CVE-2026-23738 | 6.1 | Feb 6 | The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +5 more |
| CVE-2023-49786 | 5.9 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +22 more |
| CVE-2024-42491 | 5.7 | Sep 5 | A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +14 more |
| CVE-2022-42706 | 4.9 | Dec 5 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1 Affected: before 18.9; 18.9 |
Showing 15