CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_answer. Show all products

19 CVEs, showing 1 to 19
CVESeverityTitlePublished
CVE-2026-48834High 7.5Apache Answer: Denial of service via crafted Accept-Language header parsing
Assigned by apache
Aug 5, 2026
CVE-2026-48911High 7.5Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
Assigned by apache
Aug 5, 2026
CVE-2026-48912Medium 6.5Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
Assigned by apache
Aug 5, 2026
CVE-2026-50749Medium 6.5Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
Assigned by apache
Aug 5, 2026
CVE-2026-60023High 7.5Apache Answer: Unauthorized disclosure of deleted or pending answer content
Assigned by apache
Aug 5, 2026
CVE-2026-60053Critical 9.1Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
Assigned by apache
Aug 5, 2026
CVE-2026-64943Not yet scoredApache Answer: API keys logged in plaintext during authentication
Assigned by apache
Oct 19, 2026
CVE-2026-64944Not yet scoredApache Answer: Stored XSS via unsanitized HTML in imported question content
Assigned by apache
Oct 19, 2026
CVE-2026-64945Not yet scoredApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Assigned by apache
Oct 19, 2026
CVE-2026-67249Not yet scoredApache Answer: Email Code Purpose Confusion May Allow Account Takeover
Assigned by apache
Oct 19, 2026
CVE-2026-68482Not yet scoredApache Answer: Improper Authorization in Question Invite User Lookup
Assigned by apache
Oct 19, 2026
CVE-2026-71563Not yet scoredApache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Assigned by apache
Oct 19, 2026
CVE-2026-76994Not yet scoredApache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Assigned by apache
Oct 19, 2026
CVE-2026-79613Not yet scoredApache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
Assigned by apache
Oct 19, 2026
CVE-2026-79620Not yet scoredApache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Assigned by apache
Oct 19, 2026
CVE-2026-79624Not yet scoredApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Assigned by apache
Oct 19, 2026
CVE-2026-79633Not yet scoredApache Answer: Missing Authorization Allows Mutations of Non-Public Content
Assigned by apache
Oct 19, 2026
CVE-2026-86589Not yet scoredApache Answer: User Center integration does not revoke first-login sessions after central account suspension
Assigned by apache
Oct 19, 2026
CVE-2026-90910Not yet scoredApache Answer: Reaction API authorization bypass for restricted content
Assigned by apache
Oct 19, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.