Apache Software Foundation Answer vulnerabilities

• apache software foundation answer Apache Answer: Reaction API authorization bypass for restricted content CVE-2026-90910 9.8 CriticalOctober 19, 2026
• apache software foundation answer Apache Answer: User Center integration does not revoke first-login sessions after central account suspension CVE-2026-86589 5.4 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Missing Authorization Allows Mutations of Non-Public Content CVE-2026-79633 8.1 HighOctober 19, 2026
• apache software foundation answer Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation CVE-2026-79624 9.8 CriticalOctober 19, 2026
• apache software foundation answer Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata CVE-2026-79620 4.3 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles CVE-2026-79613 5.3 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles CVE-2026-76994 7.5 HighOctober 19, 2026
• apache software foundation answer Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions CVE-2026-71563 4.3 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Improper Authorization in Question Invite User Lookup CVE-2026-68482 5.3 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Email Code Purpose Confusion May Allow Account Takeover CVE-2026-67249 5.4 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions CVE-2026-64945 7.5 HighOctober 19, 2026
• apache software foundation answer Apache Answer: Stored XSS via unsanitized HTML in imported question content CVE-2026-64944 5.4 MediumOctober 19, 2026
• apache software foundation answer Apache Answer: API keys logged in plaintext during authentication CVE-2026-64943 8.1 HighOctober 19, 2026
• apache answer Apache Answer: Residual Administrative API Key Access After Role or Account Revocation CVE-2026-60053 9.1 CriticalAugust 5, 2026
• apache answer Apache Answer: Unauthorized disclosure of deleted or pending answer content CVE-2026-60023 7.5 HighAugust 5, 2026
• apache answer Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions CVE-2026-50749 6.5 MediumAugust 5, 2026
• apache answer Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL CVE-2026-48912 6.5 MediumAugust 5, 2026
• apache answer Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow CVE-2026-48911 7.5 HighAugust 5, 2026
• apache answer Apache Answer: Denial of service via crafted Accept-Language header parsing CVE-2026-48834 7.5 HighAugust 5, 2026
• apache answer Apache Answer: AdminToken not invalidated after admin deactivation CVE-2026-25700 Fix available 7.2 HighJune 10, 2026
• apache answer Apache Answer: Unlisted Questions Accessible via Direct API Access CVE-2026-34905 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: HTML Content Injection in Email CVE-2026-34033 Fix available 5.4 MediumJune 9, 2026
• apache answer Apache Answer: The custom avatar was not properly validated CVE-2026-34031 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error CVE-2026-33582 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: Authorization Bypass in Timeline API CVE-2026-25699 Fix available 6.1 MediumJune 9, 2026
• apache answer Apache Answer: XSS in AI Answer Rendering CVE-2026-25688 Fix available 6.1 MediumJune 9, 2026
• apache answer Apache Answer: Revision API Improper Access Control leads to Information Disclosure CVE-2026-24735 Fix available 7.5 HighFebruary 4, 2026
• apache answer Apache Answer: Using externally referenced images can leak user privacy. CVE-2025-29868 Fix available 6.5 MediumApril 1, 2025
• apache answer Apache Answer: Predictable Authorization Token Using UUIDv1 CVE-2024-45719 Fix available 2.6 LowNovember 22, 2024
• apache answer Apache Answer: Avatar URL leaked user email addresses CVE-2024-40761 Fix available 5.3 MediumSeptember 25, 2024
• apache answer Apache Answer: The link for resetting user password is not Single-Use CVE-2024-41888 Fix available 5.3 MediumAugust 9, 2024
• apache answer Apache Answer: The link to reset the user's password will remain valid after sending a new link CVE-2024-41890 Fix available 5.3 MediumAugust 9, 2024
• apache answer Apache Answer: XSS vulnerability when changing personal website CVE-2024-29217 Fix available 4.6 MediumApril 21, 2024
• apache answer Apache Answer: Pixel Flood Attack by uploading the large pixel file CVE-2024-22393 Public exploitFix available 9.1 CriticalFebruary 22, 2024
• apache answer Apache Answer: XSS vulnerability when submitting summary CVE-2024-23349 Fix available 5.4 MediumFebruary 22, 2024
• apache answer Apache Answer: Repeated submission at registration created duplicate users with the same name CVE-2024-26578 Fix available 5.9 MediumFebruary 22, 2024
• apache answer Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions. CVE-2023-49619 Fix available 3.1 LowJanuary 10, 2024