Apache Software Foundation Apache Answer

CVE-2026-90910 Critical 9.8 Apache Answer: Reaction API authorization bypass for restricted content 0.5%
CVE-2026-86589 Medium 5.4 Apache Answer: User Center integration does not revoke first-login sessions after central account suspension 0.3%
CVE-2026-79633 High 8.1 Apache Answer: Missing Authorization Allows Mutations of Non-Public Content 0.3%
CVE-2026-79624 Critical 9.8 Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation 0.4%
CVE-2026-79620 Medium 4.3 Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata 0.2%
CVE-2026-79613 Medium 5.3 Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles 0.3%
CVE-2026-76994 High 7.5 Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles 0.4%
CVE-2026-71563 Medium 4.3 Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions 0.2%
CVE-2026-68482 Medium 5.3 Apache Answer: Improper Authorization in Question Invite User Lookup 0.3%
CVE-2026-67249 Medium 5.4 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover 0.2%
CVE-2026-64945 High 7.5 Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions 0.3%
CVE-2026-64944 Medium 5.4 Apache Answer: Stored XSS via unsanitized HTML in imported question content 0.2%
CVE-2026-64943 High 8.1 Apache Answer: API keys logged in plaintext during authentication 0.3%
CVE-2026-60053 Critical 9.1 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation 0.6%
CVE-2026-60023 High 7.5 Apache Answer: Unauthorized disclosure of deleted or pending answer content 0.6%
CVE-2026-50749 Medium 6.5 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions 0.5%
CVE-2026-48912 Medium 6.5 Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL 0.5%
CVE-2026-48911 High 7.5 Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow 0.6%
CVE-2026-48834 High 7.5 Apache Answer: Denial of service via crafted Accept-Language header parsing 0.8%
CVE-2026-25700 High 7.2 Apache Answer: AdminToken not invalidated after admin deactivation 0.4%
CVE-2026-34905 Medium 6.5 Apache Answer: Unlisted Questions Accessible via Direct API Access 0.3%
CVE-2026-34033 Medium 5.4 Apache Answer: HTML Content Injection in Email 0.3%
CVE-2026-34031 Medium 6.5 Apache Answer: The custom avatar was not properly validated 0.4%
CVE-2026-33582 Medium 6.5 Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error 0.5%
CVE-2026-25699 Medium 6.1 Apache Answer: Authorization Bypass in Timeline API 0.4%
CVE-2026-25688 Medium 6.1 Apache Answer: XSS in AI Answer Rendering 0.4%
CVE-2026-24735 High 7.5 Apache Answer: Revision API Improper Access Control leads to Information Disclosure 0.6%
CVE-2025-29868 Medium 6.5 Apache Answer: Using externally referenced images can leak user privacy. 1.0%
CVE-2024-45719 Low 2.6 Apache Answer: Predictable Authorization Token Using UUIDv1 0.3%
CVE-2024-40761 Medium 5.3 Apache Answer: Avatar URL leaked user email addresses 0.7%
CVE-2024-41888 Medium 5.3 Apache Answer: The link for resetting user password is not Single-Use 1.2%
CVE-2024-41890 Medium 5.3 Apache Answer: The link to reset the user's password will remain valid after sending a new link 1.1%
CVE-2024-29217 Medium 4.6 Apache Answer: XSS vulnerability when changing personal website 1.0%
CVE-2024-22393 Critical 9.1 Apache Answer: Pixel Flood Attack by uploading the large pixel file 2.5%
CVE-2024-23349 Medium 5.4 Apache Answer: XSS vulnerability when submitting summary 1.1%
CVE-2024-26578 Medium 5.9 Apache Answer: Repeated submission at registration created duplicate users with the same name 0.9%
CVE-2023-49619 Low 3.1 Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions. 0.9%