Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,645All CVEsplus 18,889 rejected
- 402Last 24 hours2,969 in the last 7 days
- 17,128Last 30 days1,580 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 20 | 0 | 1 | 0 | 24 | 44 |
| 2025 | 2 | 8 | 6 | 0 | 0 | 16 | 20 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 4 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2022 | 0 | 0 | 1 | 2 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-75600 | FreePBX: Authenticated API generatedocs Host Command InjectionFreePBX · security-reporting | High8.6 |
| CVE-2026-54710 | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)FreePBX · security-reporting | High8.6 |
| CVE-2026-54708 | Authenticated Remote Code Execution via Path Traversal in FreePBX Backup ModuleFreePBX · security-reporting | High8.6 |
| CVE-2026-54675 | FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang ModuleFreePBX · security-reporting | High8.7 |
| CVE-2026-54674 | Authenticated Command Injection in FreePBX UCP InterfaceFreePBX · security-reporting | High8.6 |
| CVE-2026-45562 | FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) ModuleFreePBX · security-reporting | High7.7 |
| CVE-2026-73665 | FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injectionFreePBX · ucp | Critical9.3 |
| CVE-2026-73664 | FreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleFreePBX · backup | High8.6 |
| CVE-2026-73663 | FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeoverFreePBX · missedcall | Critical9.3 |
| CVE-2026-73662 | Authenticated FreePBX Music RCE via mpg123 and Asterisk Call FilesFreePBX · music | High7.6 |
| CVE-2026-73661 | FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupFreePBX · framework | High8.6 |
| CVE-2026-73660 | FreePBX: Authenticated TTS AGI Command Injection Through TTS NameFreePBX · tts | High7.5 |
| CVE-2026-72578 | FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax DispatcherFreePBX · FreePBX Framework | High8.8 |
| CVE-2026-44237 | FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API ModuleFreePBX · security-reporting | High7.6 |
| CVE-2026-44238 | FreePBX: Authenticated SQL Injection via ORDER BY in CDR ReportsFreePBX · security-reporting | High8.5 |
| CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard ModuleFreePBX · security-reporting | High7.6 |
| CVE-2026-46376 | FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP InterfaceFreePBX · security-reporting | Critical9.3 |
| CVE-2026-26978 | Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpFreePBX · security-reporting | High8.6 |
| CVE-2026-40520 | FreePBX api module Command Injection via GraphQLFreePBX · api | High8.6 |
| CVE-2026-28287 | FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsFreePBX · security-reporting | High8.6 |
| CVE-2026-28284 | FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles ModuleFreePBX · security-reporting | High8.6 |
| CVE-2026-28210 | FreePBX: Authenticated SQL Injection in CDR (Call Data Record) ReportsFreePBX · security-reporting | High8.6 |
| CVE-2026-28209 | FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integrationFreePBX · security-reporting | High7.5 |
| CVE-2025-55210 | FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional ScopesFreePBX · api | Low2.0 |
| CVE-2025-67736 | Authenticated SQL Injection in FreePBX tts (Text To Speech) moduleFreePBX · tts | High8.6 |
| CVE-2025-67722 | Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalationFreePBX · framework | Medium5.7 |
| CVE-2024-58294 | FreePBX 16 Authenticated Remote Code Execution via API ModuleFreePBX · FreePBX | High8.7 |
| CVE-2025-67513 | FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST APIFreePBX · endpoint | Medium6.9 |
| CVE-2025-66039 | FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth HeaderFreePBX · framework | Critical9.3 |
| CVE-2025-62173 | Authenticated SQL Injection in Endpoint Module Rest APIFreePBX · restapps | High8.6 |
| CVE-2025-64328 | FreePBX Administration GUI is Vulnerable to Authenticated Command InjectionExploitedFreePBX · filestore | High8.6 |
| CVE-2025-61678 | FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameterFreePBX · endpointman | High8.6 |
| CVE-2025-61675 | FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersFreePBX · endpoint | High8.6 |
| CVE-2025-59429 | FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status pageFreePBX · core | High8.5 |
| CVE-2025-59051 | FreePBX Endpoint Manager command injection via Network Scanning featureFreePBX · endpoint | High8.6 |
| CVE-2025-59056 | FreePBX vulnerable to unauthenticated Denial of ServiceFreePBX · framework | Medium6.6 |
| CVE-2025-55211 | FreePBX Post-Authenticated Command InjectionFreePBX · framework | Medium6.3 |
| CVE-2025-55739 | api: Shared OAuth Signing Key Between Different InstancesFreePBX · api | Medium5.1 |
| CVE-2025-55209 | FreePBX UCP is Vulnerable to Stored XSS Through its User Control PanelFreePBX · contactmanager | Medium5.1 |
| CVE-2025-57819 | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEExploitedFreePBX · endpoint | Critical10.0 |
| CVE-2024-47071 | OSS Endpoint Manager allows unauthorized access to read system filesFreePBX · endpointman | Medium6.8 |
| CVE-2019-25090 | FreePBX arimanager Views cross site scriptingFreePBX · arimanager | Low3.5 |
| CVE-2021-4282 | FreePBX voicemail page.voicemail.php cross site scriptingFreePBX · voicemail | Low3.5 |
| CVE-2020-36630 | FreePBX cdr Cdr.class.php ajaxHandler sql injectionFreePBX · cdr | Medium5.5 |