Vulnerabilities

TI-2026-42802 CVE-2026-60053 · GHSA-53x4-p5j7-29q6

Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

MEDIUM 48

Insufficient Session Expiration vulnerability in Apache Answer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00566 Published 2026-08-05 No fix listed CWE-613

TI-2026-42790 CVE-2026-60023 · GHSA-x73g-vq9w-776v

Apache Answer: Unauthorized disclosure of deleted or pending answer content

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00622 Published 2026-08-05 No fix listed CWE-200

TI-2026-37412 CVE-2026-50749 · GHSA-47c3-m797-88v2

Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

LOW 29

Improper Authorization vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0047 Published 2026-08-05 No fix listed CWE-863

TI-2026-36172 CVE-2026-48912 · GHSA-536r-pphc-ghq8

Authorization bypass in Apache Answer

LOW 29

Improper Input Validation vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0047 Published 2026-08-05 No fix listed CWE-639

TI-2026-36171 CVE-2026-48911 · GHSA-47mw-vx77-gwvj

Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow

MEDIUM 40

Insufficient Verification of Data Authenticity vulnerability in Apache Answer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00575 Published 2026-08-05 No fix listed CWE-306

TI-2026-36100 CVE-2026-48834 · GHSA-9mxc-x85j-v2wc

Apache Answer: Denial of service via crafted Accept-Language header parsing

MEDIUM 40

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00764 Published 2026-08-05 No fix listed CWE-400

TI-2026-20774 CVE-2026-25700 · GHSA-4gw2-vg4x-7p29

Apache Answer: AdminToken not invalidated after admin deactivation

LOW 34

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00448 Published 2026-06-10 Fixed in 2.0.1 CWE-1259

TI-2026-27137 CVE-2026-34905 · GHSA-85r2-pvg8-89r9

Apache Answer: Unlisted Questions Accessible via Direct API Access

LOW 29

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00313 Published 2026-06-09 Fixed in 1.7.2-0.20260509071350-11c80384f13a CWE-200

TI-2026-26359 CVE-2026-34033 · GHSA-6qwm-5fm9-cvjx

Apache Answer: HTML Content Injection in Email

LOW 24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00334 Published 2026-06-09 Fixed in 1.7.2-0.20260509080709-d1a4092c61cc CWE-80

TI-2026-26357 CVE-2026-34031 · GHSA-x4f6-mqg6-28xx

Apache Answer: The custom avatar was not properly validated

LOW 35

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00362 Published 2026-06-09 Fixed in 1.7.2-0.20260511040518-11091244f64e CWE-434

TI-2026-25965 CVE-2026-33582 · GHSA-v553-g2w6-295p

Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error

LOW 29

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0048 Published 2026-06-09 Fixed in 1.7.2-0.20260325113131-cfc3e54f30cc CWE-434

TI-2026-20773 CVE-2026-25699 · GHSA-w754-5646-xq9j

Apache Answer: Authorization Bypass in Timeline API

LOW 27

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00406 Published 2026-06-09 Fixed in 1.7.2-0.20260206073245-92994b49976b CWE-359

TI-2026-20769 CVE-2026-25688 · GHSA-hmr2-99jm-8x45

Apache Answer: XSS in AI Answer Rendering

LOW 27

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00406 Published 2026-06-09 Fixed in 1.7.2-0.20260525024654-2746bf5b455f CWE-87

TI-2026-19940 CVE-2026-24735 · GHSA-5w5r-8xc6-2xhw

Apache Answer: Revision API Improper Access Control leads to Information Disclosure

MEDIUM 40

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00645 Published 2026-02-04 Fixed in 2.0.0 CWE-359

TI-2025-21259 CVE-2025-29868 · GHSA-wqcc-mfhw-53pc

Apache Answer: Using externally referenced images can leak user privacy.

LOW 31

Private Data Structure Returned From A Public Method vulnerability in Apache Answer.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00973 Published 2025-04-01 Fixed in 1.4.5 CWE-495

TI-2024-30700 CVE-2024-45719 · GHSA-mr95-vfcf-fx9p

Apache Answer: Predictable Authorization Token Using UUIDv1

LOW 13

Inadequate Encryption Strength vulnerability in Apache Answer.

CVSS 3.1LOW 2.6 Network High privileges User interaction EPSS 0.00263 Published 2024-11-22 Fixed in 1.4.1 CWE-326

TI-2024-27147 CVE-2024-40761 · GHSA-48cr-j2cx-mcr8

Apache Answer: Avatar URL leaked user email addresses

LOW 31

Inadequate Encryption Strength vulnerability in Apache Answer.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00749 Published 2024-09-25 Fixed in 1.4.0 CWE-326

TI-2024-27925 CVE-2024-41888 · GHSA-v3x9-wrq5-868j

Apache Answer: The link for resetting user password is not Single-Use

LOW 27

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01222 Published 2024-08-09 Fixed in 1.3.6 CWE-772

TI-2024-27927 CVE-2024-41890 · GHSA-gvpv-r32v-9737

Apache Answer: The link to reset the user's password will remain valid after sending a new link

LOW 26

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01149 Published 2024-08-09 Fixed in 1.3.6 CWE-772

TI-2024-19386 CVE-2024-29217 · GHSA-cvqr-mwh6-2vc6

Apache Answer: XSS vulnerability when changing personal website

LOW 23

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00966 Published 2024-04-21 Fixed in 1.3.0 CWE-79

TI-2024-14967 CVE-2024-22393 · GHSA-rmqp-mvv2-54c6

Apache Answer: Pixel Flood Attack by uploading the large pixel file

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02459 Published 2024-02-22 Fixed in 1.2.5 CWE-434

TI-2024-15449 CVE-2024-23349 · GHSA-8pf2-qj4v-fj64

Apache Answer: XSS vulnerability when submitting summary

LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01073 Published 2024-02-22 Fixed in 1.2.5 CWE-79

TI-2024-17463 CVE-2024-26578 · GHSA-9q24-hwmc-797x

Apache Answer: Repeated submission at registration created duplicate users with the same name

LOW 28

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00895 Published 2024-02-22 Fixed in 1.2.5 CWE-362

TI-2023-27100 CVE-2023-49619 · GHSA-f899-4mr4-fqpv

Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.

LOW 17

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00891 Published 2024-01-10 Fixed in 1.2.1 CWE-362

Vulnerabilities

Filters