CVE Tools
Track your stack

Communications

8,541 CVEs tracked since 1999. In the last 12 months, 1,764, +155% on the 12 before.

Communications by subsector, Oct 2026 so far

Oct 2026 so far: 185 CVEs across 5 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Email12467% · 12 vendors
  • Messaging & chat4323% · 17 vendors
  • VoIP & telephony137% · 5 vendors

Also: Video conferencing 4, Not yet sub-classified 1.

Month by month

Every monthly snapshot of Communications. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Communications CVEs per month
MonthCVEs
2021-1027
2021-1141
2021-1254
2022-0138
2022-0241
2022-0357
2022-0444
2022-0533
2022-0667
2022-0744
2022-0837
2022-0956
2022-1028
2022-1142
2022-1251
2023-0133
2023-0221
2023-030
2023-0437
2023-0573
2023-0656
2023-0757
2023-0862
2023-0934
2023-1071
2023-1175
2023-1268
2024-0170
2024-0267
2024-0330
2024-0449
2024-0551
2024-0628
2024-0756
2024-0877
2024-0954
2024-1054
2024-1147
2024-1228
2025-0152
2025-0256
2025-0360
2025-0489
2025-0591
2025-0653
2025-0758
2025-0853
2025-0951
2025-1054
2025-1175
2025-12186
2026-0170
2026-0279
2026-03156
2026-0489
2026-05184
2026-06156
2026-07168
2026-08207
2026-09340
2026-10185

Vendors

Who shipped the most Communications CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Roundcube20#76
  2. Mattermost16#91

Weaknesses

The weakness classes behind Communications CVEs in Oct 2026 so far.

  1. CWE-416 Use After Free26
  2. CWE-79 XSS15
  3. CWE-863 Incorrect Authorization11
  4. CWE-200 Information Exposure9
  5. CWE-125 Out-of-bounds Read7
  6. CWE-639 Auth Bypass via User Key7

Latest CVEs

The 15 most recently published vulnerabilities in Communications.

  1. CVE-2026-118076WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability8.8
  2. CVE-2026-66912Stored Cross-Site Scripting in Zimbra—
  3. CVE-2026-66911Stored Cross-Site Scripting in Zimbra—
  4. CVE-2026-93851Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post8.0
  5. CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses5.3
  6. CVE-2015-20129CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/8.8
  7. CVE-2026-57199Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers—
  8. CVE-2026-57203Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location—
  9. CVE-2026-57190Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field—
  10. CVE-2026-57191Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing—
  11. CVE-2026-57192Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch—
  12. CVE-2026-57186Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser7.5
  13. CVE-2026-57200Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE7.5
  14. CVE-2026-57195Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication7.5
  15. CVE-2026-118180Matrix homeserver could redirect the chat session to a local file or network share—

The record

Busiest month
Sep 2026, 340 CVEs
Oct 2026 so far
185 CVEs from 37 vendors
Deployment
On-prem, 100%
Monthly snapshots
297 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment