AA
Product
Apache Answer
26
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 2High 5Medium 10Low 0
Watch
Add Apache Answer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-90910 | 9.8 | Oct 19 | Apache Answer: Reaction API authorization bypass for restricted content Affected: through 2.0.2 |
| CVE-2026-60053 | 9.1 | Aug 5 | Apache Answer: Residual Administrative API Key Access After Role or Account Revocation Affected: through 2.0.1 |
| CVE-2026-64943 | 8.1 | Oct 19 | Apache Answer: API keys logged in plaintext during authentication Affected: through 2.0.2 |
| CVE-2026-60023 | 7.5 | Aug 5 | Apache Answer: Unauthorized disclosure of deleted or pending answer content Affected: through 2.0.1 |
| CVE-2026-48911 | 7.5 | Aug 5 | Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow Affected: through 2.0.1 |
| CVE-2026-48834 | 7.5 | Aug 5 | Apache Answer: Denial of service via crafted Accept-Language header parsing Affected: through 2.0.1 |
| CVE-2026-25700 | 7.2 | Jun 10 | Apache Answer: AdminToken not invalidated after admin deactivation Affected: through 2.0.0 |
| CVE-2026-50749 | 6.5 | Aug 5 | Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions Affected: through 2.0.1 |
| CVE-2026-48912 | 6.5 | Aug 5 | Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL Affected: through 2.0.1 |
| CVE-2026-34905 | 6.5 | Jun 9 | Apache Answer: Unlisted Questions Accessible via Direct API Access Affected: through 2.0.0 |
| CVE-2026-34031 | 6.5 | Jun 9 | Apache Answer: The custom avatar was not properly validated Affected: through 2.0.0 |
| CVE-2026-33582 | 6.5 | Jun 9 | Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error Affected: through 2.0.0 |
| CVE-2026-25699 | 6.1 | Jun 9 | Apache Answer: Authorization Bypass in Timeline API Affected: through 2.0.0 |
| CVE-2026-25688 | 6.1 | Jun 9 | Apache Answer: XSS in AI Answer Rendering Affected: through 2.0.0 |
| CVE-2026-67249 | 5.4 | Oct 19 | Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Affected: through 2.0.2 |
| CVE-2026-34033 | 5.4 | Jun 9 | Apache Answer: HTML Content Injection in Email Affected: through 2.0.0 |
| CVE-2026-71563 | 4.3 | Oct 19 | Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Affected: through 2.0.2 |
| CVE-2026-86589 | – | Oct 19 | Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Affected: through 2.0.2 |
| CVE-2026-79633 | – | Oct 19 | Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Affected: through 2.0.2 |
| CVE-2026-79624 | – | Oct 19 | Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Affected: through 2.0.2 |
| CVE-2026-79620 | – | Oct 19 | Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Affected: through 2.0.2 |
| CVE-2026-79613 | – | Oct 19 | Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Affected: through 2.0.2 |
| CVE-2026-76994 | – | Oct 19 | Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Affected: through 2.0.2 |
| CVE-2026-68482 | – | Oct 19 | Apache Answer: Improper Authorization in Question Invite User Lookup Affected: through 2.0.2 |
| CVE-2026-64945 | – | Oct 19 | Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Affected: through 2.0.2 |
| CVE-2026-64944 | – | Oct 19 | Apache Answer: Stored XSS via unsanitized HTML in imported question content Affected: through 2.0.2 |
Showing 26