Login Request a demo
AA
Product
Apache Answer
by Apache Software Foundation · last CVE Oct 19, 2026
32
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Vulnerabilities32In the news0Timeline
Severity mix
Critical 2High 6Medium 14Low 1
Severity
All severities32Critical2High6Medium14Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Answer to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-50749
6.5
0%
Aug 5
Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
Affected: through 2.0.1
CVE-2026-48912
6.5
0%
Aug 5
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
Affected: through 2.0.1
CVE-2026-34905
6.5
0%
Jun 9
Apache Answer: Unlisted Questions Accessible via Direct API Access
Affected: through 2.0.0
CVE-2026-34031
6.5
0%
Jun 9
Apache Answer: The custom avatar was not properly validated
Affected: through 2.0.0
CVE-2026-33582
6.5
0%
Jun 9
Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error
Affected: through 2.0.0
CVE-2025-29868
6.5
1%
Apr 1
Apache Answer: Using externally referenced images can leak user privacy.
Affected: through 1.4.2
CVE-2026-25699
6.1
0%
Jun 9
Apache Answer: Authorization Bypass in Timeline API
Affected: through 2.0.0
CVE-2026-25688
6.1
0%
Jun 9
Apache Answer: XSS in AI Answer Rendering
Affected: through 2.0.0
CVE-2026-67249
5.4
0%
Oct 19
Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Affected: through 2.0.2
CVE-2026-34033
5.4
0%
Jun 9
Apache Answer: HTML Content Injection in Email
Affected: through 2.0.0
CVE-2024-40761
5.3
1%
Sep 25
Apache Answer: Avatar URL leaked user email addresses
Affected: through 1.3.5
CVE-2024-41888
5.3
1%
Aug 9
Apache Answer: The link for resetting user password is not Single-Use
Affected: through 1.3.5
CVE-2024-41890
5.3
1%
Aug 9
Apache Answer: The link to reset the user's password will remain valid after sending a new link
Affected: through 1.3.5
CVE-2026-71563
4.3
0%
Oct 19
Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Affected: through 2.0.2
Showing 14