CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,335 CVEs published, 225 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,335
Show in the list
Critical, last 7 days
225
Show in the list
Healthcare-tagged, last 7 days
3
Show in the list
Known exploited (CISA KEV)
1,764
Show in the list

Showing CVEs that name the product sangoma:freepbx. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

26 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2019-19006
Known exploited
Critical 9.8Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Assigned by mitre
Nov 21, 2019
CVE-2025-57819
Known exploited
Critical 10.0FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
Assigned by GitHub_M
Aug 28, 2025
CVE-2025-59429High 8.5FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page
Assigned by GitHub_M
Oct 14, 2025
CVE-2025-66039Critical 9.3FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Assigned by GitHub_M
Dec 9, 2025
CVE-2024-58294High 8.7FreePBX 16 Authenticated Remote Code Execution via API Module
Assigned by VulnCheck
Dec 11, 2025
CVE-2025-67722Medium 5.7Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
Assigned by GitHub_M
Dec 15, 2025
CVE-2025-67736High 8.6Authenticated SQL Injection in FreePBX tts (Text To Speech) module
Assigned by GitHub_M
Dec 15, 2025
CVE-2025-55210Low 2.0FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes
Assigned by GitHub_M
Feb 12, 2026
CVE-2026-28209High 7.5FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
Assigned by GitHub_M
Mar 5, 2026
CVE-2026-28210High 8.6FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
Assigned by GitHub_M
Mar 5, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .