16
CVEs
1
Critical
10
High
2
KEV
3
PoC
6
Unpatched C/H
37.5%
Patch Rate
5.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
10
MEDIUM
0
LOW
3
Monthly CVE Trend
Affected Products (24)
Asterisk
25
Certified Asterisk
21
Freepbx
20
PHP
9
Switchvox Smb Edition
4
Debian Linux
3
Open Source
2
Pjsip
2
Session Border Controller Firmware
2
Firestore
1
Switchvox
1
Digiumphones
1
AI / ML
1
Industrial
1
Manager
1
Contactmanager
1
Fedora
1
Restapps
1
Img2020 Firmware
1
Business Edition
1
PostgreSQL
1
Freepbx Linux 7
1
Netborder Vega Session Firmware
1
MySQL
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-64328 | FreePBX Endpoint Manager contains a post-authentication command injection via the testconnection/check_ssh_connect function, allowing authenticated users to execute OS commands. | HIGH | 8.6 | 81.9% | 210 |
KEV
PoC
No patch
|
| CVE-2026-9586 | Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrary SQL against the backend PostgreSQL database via the /pa endpoint, which concatenates the attacker-supplied PhoneIP value from a <PolycomIPPhone> XML body into queries without parameterization. Because SQL access on this PostgreSQL deployment can be escalated to command execution, a single crafted, unauthenticated request yields full database compromise and remote code execution on the VoIP appliance. There is no public exploit identified at time of analysis, though vendor SRA published a technical writeup, and the CVSS 4.0 base score is 9.3 (Critical). | CRITICAL | 9.3 | 0.4% | 117 |
KEV
PoC
|
| CVE-2026-28287 | Unauthenticated command injection in FreePBX recordings module (versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4) allows authenticated attackers to execute arbitrary system commands with full system privileges. The vulnerability stems from improper input validation in the recordings functionality, enabling complete compromise of affected FreePBX installations. No patch is currently available. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-28210 | Unauthenticated SQL injection in the FreePBX CDR module (versions before 16.0.49 and 17.0.7) allows authenticated users to execute arbitrary SQL commands and potentially compromise the entire database. An attacker with valid credentials can exploit this vulnerability to read sensitive call records, modify system data, or escalate privileges within the FreePBX system. No patch is currently available, leaving affected installations at high risk until upgrades are deployed. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-28284 | SQL injection in the FreePBX logfiles module allows authenticated attackers to manipulate database queries and potentially extract sensitive data or modify system records. Versions prior to 16.0.10 and 17.0.5 are vulnerable, and attackers with valid FreePBX credentials can exploit this weakness to achieve high-impact unauthorized access to confidential information and system integrity. No patch is currently available for affected deployments. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-9585 | Reflected cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted link. The flaw stems from the application reflecting an unsanitized 'portal' parameter into JavaScript emitted by the invalid_browser and invalid_browser_login handlers. No public exploit is identified at time of analysis, though the reporting researcher (SRA) has published a technical writeup, and no evidence of active exploitation exists. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2025-55210 | Freepbx versions up to 17.0.5 contains a vulnerability that allows attackers to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX tha (CVSS 7.5). | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2026-28209 | Unauthenticated command injection in FreePBX versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 via the ElevenLabs Text-to-Speech integration allows authenticated users with high privileges to execute arbitrary system commands. The vulnerability exists in the recordings module and affects all installations using the vulnerable TTS engine. No patch is currently available, leaving affected systems at risk of full system compromise. | HIGH | 7.2 | 0.2% | 36 |
No patch
|
| CVE-2026-9587 | Arbitrary file read in Sangoma Switchvox SMB Edition 8.3 (build 104997) allows an authenticated user to disclose sensitive files anywhere on the appliance filesystem. The play_file functionality trusts the user-controlled sound_path parameter and fails to validate paths, so supplying an absolute path escapes the intended sound directory. No public exploit code is identified, but a detailed technical write-up from the reporting researchers (SRA) exists, and the flaw is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-9588 | Stored cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an authenticated user inject persistent JavaScript through the voicemail notification template feature, which then executes in the browsers of other users who view the affected template. The payload is submitted via the template_text parameter to the submit_modify_voicemail_template endpoint, which fails to sanitize HTML. No public exploit identified at time of analysis, though the flaw was disclosed with a technical writeup by researchers at SRA; it is not listed in CISA KEV. | HIGH | 7.0 | 0.2% | 35 |
|
| CVE-2026-23738 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. [CVSS 3.5 LOW] | LOW | 3.5 | 0.0% | 18 |
No patch
|
| CVE-2026-45362 | Sangoma Switchvox before version 8.4 stores SIP authentication credentials in cleartext within backup files, allowing local attackers with physical or filesystem access to recover credentials with low complexity. This information disclosure vulnerability affects systems using the default backup functionality and has a publicly documented proof-of-concept exploit available on GitHub. | LOW | 3.2 | 0.0% | 16 |
|
| CVE-2026-23739 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can ... | LOW | 2.0 | 0.1% | 10 |
No patch
|
| CVE-2026-23741 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. | NONE | – | 0.0% | 0 |
No patch
|
| CVE-2026-23740 | Asterisk is an open source private branch exchange and telephony toolkit. | NONE | – | 0.0% | 0 |
No patch
|