CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 12:23 PM ET )
This week: 4,060 CVEs published, 337 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,060 Show in the list Critical, last 7 days 337 Show in the list Healthcare-tagged, last 7 days 8 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product apache_software_foundation:apache_answer . Show all products
27 CVEs, showing 1 to 27
CVE Severity Title Published CVE-2026-24735 High 7.5 Apache Answer: Revision API Improper Access Control leads to Information Disclosure Assigned by apache
Feb 4, 2026 CVE-2026-25688 Medium 6.1 Apache Answer: XSS in AI Answer Rendering Assigned by apache
Jun 9, 2026 CVE-2026-25699 Medium 6.1 Apache Answer: Authorization Bypass in Timeline API Assigned by apache
Jun 9, 2026 CVE-2026-33582 Medium 6.5 Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error Assigned by apache
Jun 9, 2026 CVE-2026-34031 Medium 6.5 Apache Answer: The custom avatar was not properly validated Assigned by apache
Jun 9, 2026 CVE-2026-34033 Medium 5.4 Apache Answer: HTML Content Injection in Email Assigned by apache
Jun 9, 2026 CVE-2026-34905 Medium 6.5 Apache Answer: Unlisted Questions Accessible via Direct API Access Assigned by apache
Jun 9, 2026 CVE-2026-25700 High 7.2 Apache Answer: AdminToken not invalidated after admin deactivation Assigned by apache
Jun 10, 2026 CVE-2026-48834 High 7.5 Apache Answer: Denial of service via crafted Accept-Language header parsing Assigned by apache
Aug 5, 2026 CVE-2026-48911 High 7.5 Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow Assigned by apache
Aug 5, 2026 CVE-2026-48912 Medium 6.5 Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL Assigned by apache
Aug 5, 2026 CVE-2026-50749 Medium 6.5 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions Assigned by apache
Aug 5, 2026 CVE-2026-60023 High 7.5 Apache Answer: Unauthorized disclosure of deleted or pending answer content Assigned by apache
Aug 5, 2026 CVE-2026-60053 Critical 9.1 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation Assigned by apache
Aug 5, 2026 CVE-2026-64943 High 8.1 Apache Answer: API keys logged in plaintext during authentication Assigned by apache
Oct 19, 2026 CVE-2026-64944 Not yet scored Apache Answer: Stored XSS via unsanitized HTML in imported question content Assigned by apache
Oct 19, 2026 CVE-2026-64945 Not yet scored Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Assigned by apache
Oct 19, 2026 CVE-2026-67249 Medium 5.4 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Assigned by apache
Oct 19, 2026 CVE-2026-68482 Not yet scored Apache Answer: Improper Authorization in Question Invite User Lookup Assigned by apache
Oct 19, 2026 CVE-2026-71563 Medium 4.3 Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Assigned by apache
Oct 19, 2026 CVE-2026-76994 Not yet scored Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Assigned by apache
Oct 19, 2026 CVE-2026-79613 Not yet scored Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Assigned by apache
Oct 19, 2026 CVE-2026-79620 Not yet scored Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Assigned by apache
Oct 19, 2026 CVE-2026-79624 Not yet scored Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Assigned by apache
Oct 19, 2026 CVE-2026-79633 Not yet scored Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Assigned by apache
Oct 19, 2026 CVE-2026-86589 Not yet scored Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Assigned by apache
Oct 19, 2026 CVE-2026-90910 Critical 9.8 Apache Answer: Reaction API authorization bypass for restricted content Assigned by apache
Oct 19, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
