CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 5:40 AM ET )
This week: 4,043 CVEs published, 329 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,043 Show in the list Critical, last 7 days 329 Show in the list Healthcare-tagged, last 7 days 9 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product apache_software_foundation:apache_answer . Show all products
27 CVEs, showing 1 to 27
CVE Severity Title Published CVE-2026-90910 Critical 9.8 Apache Answer: Reaction API authorization bypass for restricted content Assigned by apache
Oct 19, 2026 CVE-2026-86589 Not yet scored Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Assigned by apache
Oct 19, 2026 CVE-2026-79633 Not yet scored Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Assigned by apache
Oct 19, 2026 CVE-2026-79624 Not yet scored Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Assigned by apache
Oct 19, 2026 CVE-2026-79620 Not yet scored Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Assigned by apache
Oct 19, 2026 CVE-2026-79613 Not yet scored Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Assigned by apache
Oct 19, 2026 CVE-2026-76994 Not yet scored Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Assigned by apache
Oct 19, 2026 CVE-2026-71563 Medium 4.3 Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Assigned by apache
Oct 19, 2026 CVE-2026-68482 Not yet scored Apache Answer: Improper Authorization in Question Invite User Lookup Assigned by apache
Oct 19, 2026 CVE-2026-67249 Not yet scored Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Assigned by apache
Oct 19, 2026 CVE-2026-64945 Not yet scored Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Assigned by apache
Oct 19, 2026 CVE-2026-64944 Not yet scored Apache Answer: Stored XSS via unsanitized HTML in imported question content Assigned by apache
Oct 19, 2026 CVE-2026-64943 High 8.1 Apache Answer: API keys logged in plaintext during authentication Assigned by apache
Oct 19, 2026 CVE-2026-60053 Critical 9.1 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation Assigned by apache
Aug 5, 2026 CVE-2026-60023 High 7.5 Apache Answer: Unauthorized disclosure of deleted or pending answer content Assigned by apache
Aug 5, 2026 CVE-2026-50749 Medium 6.5 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions Assigned by apache
Aug 5, 2026 CVE-2026-48912 Medium 6.5 Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL Assigned by apache
Aug 5, 2026 CVE-2026-48911 High 7.5 Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow Assigned by apache
Aug 5, 2026 CVE-2026-48834 High 7.5 Apache Answer: Denial of service via crafted Accept-Language header parsing Assigned by apache
Aug 5, 2026 CVE-2026-25700 High 7.2 Apache Answer: AdminToken not invalidated after admin deactivation Assigned by apache
Jun 10, 2026 CVE-2026-34905 Medium 6.5 Apache Answer: Unlisted Questions Accessible via Direct API Access Assigned by apache
Jun 9, 2026 CVE-2026-34033 Medium 5.4 Apache Answer: HTML Content Injection in Email Assigned by apache
Jun 9, 2026 CVE-2026-34031 Medium 6.5 Apache Answer: The custom avatar was not properly validated Assigned by apache
Jun 9, 2026 CVE-2026-33582 Medium 6.5 Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error Assigned by apache
Jun 9, 2026 CVE-2026-25699 Medium 6.1 Apache Answer: Authorization Bypass in Timeline API Assigned by apache
Jun 9, 2026 CVE-2026-25688 Medium 6.1 Apache Answer: XSS in AI Answer Rendering Assigned by apache
Jun 9, 2026 CVE-2026-24735 High 7.5 Apache Answer: Revision API Improper Access Control leads to Information Disclosure Assigned by apache
Feb 4, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
