SA
Vendor
Sangoma
112
CVEs
6
On KEV
6
New 30D
Products
FR9.8
FreePBX
Sangoma
51 CVEs3 on KEV6 new
SS9.8
Switchvox SMB Edition
Sangoma
4 CVEs1 on KEV0 new
SW9.8
Switchvox
Sangoma
3 CVEs1 on KEV0 new
FI7.2
Filestore
Sangoma
1 CVEs1 on KEV0 new
AS9.8
Asterisk
Sangoma
28 CVEs0 on KEV0 new
CA8.8
Certified Asterisk
Sangoma
15 CVEs0 on KEV0 new
RE9.8
Restapps
Sangoma
2 CVEs0 on KEV0 new
SB9.8
Session Border Controller Firmware
Sangoma
2 CVEs0 on KEV0 new
VO6.1
Voicemail
Sangoma
2 CVEs0 on KEV0 new
FL8.1
Freepbx Linux 7
Sangoma
1 CVEs0 on KEV0 new
IF9.8
Img2020 Firmware
Sangoma
1 CVEs0 on KEV0 new
NS9.8
Netborder/vega Session Firmware
Sangoma
1 CVEs0 on KEV0 new
WA–
Wanpipe
Sangoma
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-75600 | FR Freepbx Sangoma | 8.8 | Sep 28 | FreePBX: Authenticated API generatedocs Host Command Injection |
| CVE-2026-54710 | FR Freepbx Sangoma | 8.8 | Sep 28 | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) |
| CVE-2026-54708 | FR Freepbx Sangoma | 8.8 | Sep 28 | Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module |
| CVE-2026-54675 | FR Freepbx Sangoma | 8.8 | Sep 28 | FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module |
| CVE-2026-54674 | FR Freepbx Sangoma | 8.8 | Sep 28 | Authenticated Command Injection in FreePBX UCP Interface |
| CVE-2026-45562 | FR Freepbx Sangoma | 7.2 | Sep 28 | FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module |
| CVE-2026-73665 | FR Freepbx Sangoma | 9.8 | Aug 13 | FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection |
| CVE-2026-73663 | FR Freepbx Sangoma | 9.8 | Aug 13 | FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover |
| CVE-2026-73662 | FR Freepbx Sangoma | 7.2 | Aug 13 | Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files |
| CVE-2026-73661 | FR Freepbx Sangoma | 6.5 | Aug 13 | FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup |
| CVE-2026-9588 | SS Switchvox SMB Edition Sangoma | 7.0 | Jul 17 | Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal |
| CVE-2026-9587 | SS Switchvox SMB Edition Sangoma | 7.1 | Jul 17 | Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal |
| CVE-2026-9586 In wildKEV | SS Switchvox SMB Edition Sangoma | 9.8 | Jul 17 | Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB |
| CVE-2026-9585 | SS Switchvox SMB Edition Sangoma | 8.6 | Jul 17 | Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal |
| CVE-2026-44237 | FR Freepbx Sangoma | 8.1 | May 29 | FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module |
| CVE-2026-44238 | FR Freepbx Sangoma | 8.8 | May 29 | FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports |
| CVE-2026-44239 | FR Freepbx Sangoma | 8.8 | May 29 | FreePBX: Authenticated Local File Inclusion in Dashboard Module |
| CVE-2026-46376 | FR Freepbx Sangoma | 9.8 | May 29 | FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface |
| CVE-2026-45362 | SW Switchvox Sangoma | 3.2 | May 12 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file |
| CVE-2026-28287 | FR Freepbx Sangoma | 8.8 | Mar 5 | FreePBX is an open source IP PBX |
| CVE-2026-28284 | FR Freepbx Sangoma | 8.8 | Mar 5 | FreePBX is an open source IP PBX |
| CVE-2026-28210 | FR Freepbx Sangoma | 8.8 | Mar 5 | FreePBX is an open source IP PBX |
| CVE-2026-28209 | FR Freepbx Sangoma | 7.2 | Mar 5 | FreePBX is an open source IP PBX |
| CVE-2025-55210 | FR Freepbx Sangoma | 7.5 | Feb 12 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk |
| CVE-2026-23741 | CA Certified Asterisk Sangoma | 8.8 | Feb 6 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2026-23740 | AS Asterisk Sangoma | 7.8 | Feb 6 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2026-23739 | AS Asterisk Sangoma | 6.5 | Feb 6 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2026-23738 | AS Asterisk Sangoma | 6.1 | Feb 6 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2025-67736 | FR Freepbx Sangoma | 7.2 | Dec 16 | The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk |
| CVE-2025-67722 | FR Freepbx Sangoma | 7.8 | Dec 16 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk |
| CVE-2024-58294 | FR Freepbx Sangoma | 8.8 | Dec 11 | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands |
| CVE-2025-66039 | FR Freepbx Sangoma | 9.8 | Dec 9 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems |
| CVE-2025-64328 In wildKEV | FI Filestore Sangoma | 7.2 | Nov 7 | FreePBX Administration GUI is Vulnerable to Authenticated Command Injection |
| CVE-2025-59429 | FR Freepbx Sangoma | 5.4 | Oct 14 | FreePBX is an open source GUI for managing Asterisk |
| CVE-2025-1131 | CA Certified Asterisk Sangoma | 7.8 | Sep 23 | A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package |
| CVE-2025-59056 | FR Freepbx Sangoma | 7.5 | Sep 15 | FreePBX is an open-source web-based graphical user interface |
| CVE-2025-55211 | FR Freepbx Sangoma | 8.8 | Sep 15 | FreePBX is an open-source web-based graphical user interface |
| CVE-2025-57819 In wildKEV | FR Freepbx Sangoma | 9.8 | Aug 28 | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE |
| CVE-2025-57767 | AS Asterisk Sangoma | 7.5 | Aug 28 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2025-54995 | CA Certified Asterisk Sangoma | 6.5 | Aug 28 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2025-49832 | AS Asterisk Sangoma | 6.5 | Aug 1 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2025-32105 | IF Img2020 Firmware Sangoma | 9.8 | Jun 3 | A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution |
| CVE-2025-47780 | CA Certified Asterisk Sangoma | 7.8 | May 22 | Asterisk is an open-source private branch exchange (PBX) |
| CVE-2025-47779 | AS Asterisk Sangoma | 6.5 | May 22 | Asterisk is an open-source private branch exchange (PBX) |
| CVE-2024-57520 | AS Asterisk Sangoma | 9.8 | Feb 5 | Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function |
| CVE-2024-53566 | AS Asterisk Sangoma | 5.5 | Dec 2 | An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal |
| CVE-2024-53564 | FR Freepbx Sangoma | 7.2 | Dec 2 | A vulnerability was discovered in FreePBX 17.0.19.17 |
| CVE-2024-42491 | AS Asterisk Sangoma | 5.7 | Sep 5 | A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used |
| CVE-2024-35190 | AS Asterisk Sangoma | 5.3 | May 17 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2023-49786 | CA Certified Asterisk Sangoma | 5.9 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2023-49294 | CA Certified Asterisk Sangoma | 7.5 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2023-37457 | CA Certified Asterisk Sangoma | 8.2 | Dec 14 | Asterisk is an open source private branch exchange and telephony toolkit |
| CVE-2023-43336 | FR Freepbx Sangoma | 8.8 | Nov 2 | Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing… |
| CVE-2023-26567 | FL Freepbx Linux 7 Sangoma | 8.1 | Apr 26 | Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables |
| CVE-2019-25090 | FR Freepbx Sangoma | 6.1 | Dec 27 | A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic |
| CVE-2021-4283 | VO Voicemail Sangoma | 5.4 | Dec 27 | A vulnerability was found in FreeBPX voicemail |
| CVE-2021-4282 | VO Voicemail Sangoma | 6.1 | Dec 27 | A vulnerability was found in FreePBX voicemail |
| CVE-2020-36630 | FR Freepbx Sangoma | 9.8 | Dec 25 | A vulnerability was found in FreePBX cdr 14.0 |
| CVE-2022-42706 | AS Asterisk Sangoma | 4.9 | Dec 5 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1 |
| CVE-2022-42705 | AS Asterisk Sangoma | 6.5 | Dec 5 | A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of… |