Apache Answer vulnerabilities

24 CVEs affecting Apache Answer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60053, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-22393, published 2024-02-22. Critical severity, CVSS 9.1. EPSS: 2.5% chance of exploitation in the next 30 days. Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server…
CVE-2024-41888, published 2024-08-12. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration…
CVE-2024-41890, published 2024-08-12. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a…
CVE-2024-23349, published 2024-02-22. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters…
CVE-2024-29217, published 2024-04-21. Medium severity, CVSS 4.6. EPSS: 1% chance of exploitation in the next 30 days. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes…
CVE-2025-29868, published 2025-04-01. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user…
CVE-2024-26578, published 2024-02-22. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Repeated submission during…
CVE-2023-49619, published 2024-01-10. Low severity, CVSS 3.1. EPSS: 0.9% chance of exploitation in the next 30 days. Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer: through 1.2.0. Under normal…
CVE-2026-48834, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a…
CVE-2024-40761, published 2024-09-25. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to…

Latest

CVE-2026-60053, published 2026-08-05. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted…
CVE-2026-60023, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by…
CVE-2026-50749, published 2026-08-05. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission…
CVE-2026-48912, published 2026-08-05. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to…
CVE-2026-48911, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding…
CVE-2026-25700, published 2026-06-10. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after…
CVE-2026-34905, published 2026-06-09. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access…
CVE-2026-34033, published 2026-06-09. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in…
CVE-2026-34031, published 2026-06-09. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs,…