Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/apache/answer

9 known vulnerabilities (2 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 high, 7 medium
Registry
pkg.go.dev

Advisories 9

  • Apache Answer: AdminToken not invalidated after admin deactivation

    Affected: all versions; fixed in 2.0.1.

  • CVE-2026-34905Medium 6.5

    Apache Answer: Unlisted Questions Accessible via Direct API Access

    Affected: fixed in 1.7.2-0.20260509071350-11c80384f13a.

  • CVE-2026-34033Medium 5.4

    Apache Answer: HTML Content Injection in Email

    Affected: fixed in 1.7.2-0.20260509080709-d1a4092c61cc.

  • CVE-2026-34031Medium 6.5

    Apache Answer: The custom avatar was not properly validated

    Affected: fixed in 1.7.2-0.20260511040518-11091244f64e.

  • CVE-2026-33582Medium 6.5

    Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error

    Affected: fixed in 1.7.2-0.20260325113131-cfc3e54f30cc.

  • CVE-2026-25699Medium 6.1

    Apache Answer: Authorization Bypass in Timeline API

    Affected: fixed in 1.7.2-0.20260206073245-92994b49976b.

  • CVE-2026-25688Medium 6.1

    Apache Answer: XSS in AI Answer Rendering

    Affected: fixed in 1.7.2-0.20260525024654-2746bf5b455f.

  • Apache Answer: Revision API Improper Access Control leads to Information Disclosure

    Affected: all versions; fixed in 2.0.0.

  • CVE-2025-29868Medium 6.5

    Apache Answer: Using externally referenced images can leak user privacy.

    Affected: fixed in 1.4.5.