Product by Apache Software Foundation

    Apache Answer

    37 known vulnerabilities in Apache Answer (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    37

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Answer (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    CriticalCVE-2024-22393

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    		9.1
    CriticalCVE-2026-90910

    Apache Answer: Reaction API authorization bypass for restricted content

    		9.8
    CriticalCVE-2026-60053

    Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

    		9.1
    HighCVE-2026-48834

    Apache Answer: Denial of service via crafted Accept-Language header parsing

    		7.5
    HighCVE-2026-60023

    Apache Answer: Unauthorized disclosure of deleted or pending answer content

    		7.5
    HighCVE-2026-64943

    Apache Answer: API keys logged in plaintext during authentication

    		8.1
    HighCVE-2026-48911

    Apache Answer: Missing Authentication for Critical Function

    		7.5
    HighCVE-2026-25700

    Apache Answer: AdminToken not invalidated after admin deactivation

    		7.2
    HighCVE-2026-24735

    Apache Answer: Revision API Improper Access Control leads to Information Disclosure

    		7.5
    MediumCVE-2026-33582

    Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error

    		6.5
    MediumCVE-2026-34031

    Apache Answer: The custom avatar was not properly validated

    		6.5
    MediumCVE-2025-29868

    Apache Answer: Private Data Structure Returned From A Public Method

    		6.5
    MediumCVE-2024-41888

    Apache Answer: The link for resetting user password is not Single-Use

    		5.3
    MediumCVE-2026-50749

    Apache Answer: Incorrect Authorization

    		6.5
    MediumCVE-2026-48912

    Apache Answer: Authorization Bypass Through User-Controlled Key

    		6.5
    MediumCVE-2024-41890

    Apache Answer: The link to reset the user's password will remain valid after sending a new link

    		5.3
    MediumCVE-2026-25699

    Apache Answer: Authorization Bypass in Timeline API

    		6.1
    MediumCVE-2026-25688

    Apache Answer: XSS in AI Answer Rendering

    		6.1
    MediumCVE-2026-34905

    Apache Answer: Unlisted Questions Accessible via Direct API Access

    		6.5
    MediumCVE-2024-23349

    Apache Answer: XSS vulnerability when submitting summary

    		5.4
    MediumCVE-2024-26578

    Apache Answer: Repeated submission at registration created duplicate users with the same name

    		5.9
    MediumCVE-2026-34033

    Apache Answer: HTML Content Injection in Email

    		5.4
    MediumCVE-2024-29217

    Apache Answer: XSS vulnerability when changing personal website

    		4.6
    MediumCVE-2024-40761

    Apache Answer: Avatar URL leaked user email addresses

    		5.3
    MediumCVE-2026-71563

    Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

    		4.3

    All vulnerabilities in search

    News

    All products by Apache Software Foundation