EN

en direct

CVE-2026-48710 · Kludex Starlette CVE-2026-49869 · Kestra Kestra OSS CVE-2026-59822 · BerriAI LiteLLM · CVSS 8.2 CVE-2026-82329 · JFrog Artifactory

éditeur

Sangoma

1: vulnérabilité suivie
1: en exploitation active
1: critiques
2 septembre 2026: dernière publication

cve

Veille des vulnérabilités

identifiantvulnérabilitésévéritépublié

CVE-2026-9586An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.Sangoma Switchvox Critique CVSS 9.3 02/09