AN
Product
Answer
24
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 15Low 2
Watch
Add Answer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-60053 | 9.1 | Aug 5 | Apache Answer: Residual Administrative API Key Access After Role or Account Revocation Affected: before 2.0.2 |
| CVE-2024-22393 | 9.1 | Feb 22 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1 Affected: before 1.2.5 |
| CVE-2026-60023 | 7.5 | Aug 5 | Apache Answer: Unauthorized disclosure of deleted or pending answer content Affected: before 2.0.2 |
| CVE-2026-48911 | 7.5 | Aug 5 | Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow Affected: before 2.0.2 |
| CVE-2026-48834 | 7.5 | Aug 5 | Apache Answer: Denial of service via crafted Accept-Language header parsing Affected: before 2.0.2 |
| CVE-2026-24735 | 7.5 | Feb 4 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer Affected: before 2.0.0 |
| CVE-2026-25700 | 7.2 | Jun 10 | Apache Answer: AdminToken not invalidated after admin deactivation Affected: before 2.0.1 |
| CVE-2026-50749 | 6.5 | Aug 5 | Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions Affected: before 2.0.2 |
| CVE-2026-48912 | 6.5 | Aug 5 | Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL Affected: before 2.0.2 |
| CVE-2026-34905 | 6.5 | Jun 9 | Apache Answer: Unlisted Questions Accessible via Direct API Access Affected: before 2.0.1 |
| CVE-2026-34031 | 6.5 | Jun 9 | Apache Answer: The custom avatar was not properly validated Affected: before 2.0.1 |
| CVE-2026-33582 | 6.5 | Jun 9 | Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error Affected: before 2.0.1 |
| CVE-2025-29868 | 6.5 | Apr 1 | Private Data Structure Returned From A Public Method vulnerability in Apache Answer Affected: through 1.4.2 |
| CVE-2026-25699 | 6.1 | Jun 9 | Apache Answer: Authorization Bypass in Timeline API Affected: before 2.0.1 |
| CVE-2026-25688 | 6.1 | Jun 9 | Apache Answer: XSS in AI Answer Rendering Affected: before 2.0.1 |
| CVE-2024-26578 | 5.9 | Feb 22 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1 Affected: through 1.2.1 |
| CVE-2026-34033 | 5.4 | Jun 9 | Apache Answer: HTML Content Injection in Email Affected: before 2.0.1 |
| CVE-2024-23349 | 5.4 | Feb 22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1 Affected: through 1.2.1 |
| CVE-2024-40761 | 5.3 | Sep 25 | Inadequate Encryption Strength vulnerability in Apache Answer Affected: through 1.3.5 |
| CVE-2024-41890 | 5.3 | Aug 12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer Affected: before 1.3.6 |
| CVE-2024-41888 | 5.3 | Aug 12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer Affected: before 1.3.6 |
| CVE-2024-29217 | 4.6 | Apr 21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0 Affected: before 1.3.0 |
| CVE-2023-49619 | 3.1 | Jan 10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer Affected: before 1.2.1 |
| CVE-2024-45719 | 2.6 | Nov 22 | Inadequate Encryption Strength vulnerability in Apache Answer Affected: before 1.4.1 |
Showing 24