CA
Product
Certified Asterisk
15
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 9Low 0
Watch
Add Certified Asterisk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23739 | 6.5 | Feb 6 | Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +5 more |
| CVE-2025-54995 | 6.5 | Aug 28 | Asterisk remotely exploitable leak of RTP UDP ports and internal resources Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +14 more |
| CVE-2025-49832 | 6.5 | Aug 1 | Asterisk is an open source private branch exchange and telephony toolkit Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +3 more |
| CVE-2025-47779 | 6.5 | May 22 | Asterisk is an open-source private branch exchange (PBX) Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +18 more |
| CVE-2022-42705 | 6.5 | Dec 5 | A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of… Affected: 18.9 |
| CVE-2026-23738 | 6.1 | Feb 6 | The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization Affected: through 18.9; 20.7; 20.7; 20.7; 20.7; 20.7; +5 more |
| CVE-2023-49786 | 5.9 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +22 more |
| CVE-2024-42491 | 5.7 | Sep 5 | A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used Affected: before 18.9; 18.9; 18.9; 18.9; 18.9; 18.9; +14 more |
| CVE-2022-42706 | 4.9 | Dec 5 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1 Affected: before 18.9; 18.9 |
Showing 9