Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/apache/incubator-answer

16 known vulnerabilities (1 critical, 1 high, 12 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
16 · 1 critical, 1 high, 12 medium, 2 low
Registry
pkg.go.dev

Advisories 16

  • Apache Answer: AdminToken not invalidated after admin deactivation

    Affected: all versions; fixed in 2.0.1.

  • CVE-2026-34905Medium 6.5

    Apache Answer: Unlisted Questions Accessible via Direct API Access

    Affected: fixed in 1.7.2-0.20260509071350-11c80384f13a.

  • CVE-2026-34033Medium 5.4

    Apache Answer: HTML Content Injection in Email

    Affected: fixed in 1.7.2-0.20260509080709-d1a4092c61cc.

  • CVE-2026-34031Medium 6.5

    Apache Answer: The custom avatar was not properly validated

    Affected: fixed in 1.7.2-0.20260511040518-11091244f64e.

  • CVE-2026-33582Medium 6.5

    Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error

    Affected: fixed in 1.7.2-0.20260325113131-cfc3e54f30cc.

  • CVE-2026-25699Medium 6.1

    Apache Answer: Authorization Bypass in Timeline API

    Affected: fixed in 1.7.2-0.20260206073245-92994b49976b.

  • CVE-2026-25688Medium 6.1

    Apache Answer: XSS in AI Answer Rendering

    Affected: fixed in 1.7.2-0.20260525024654-2746bf5b455f.

  • Apache Answer: Predictable Authorization Token Using UUIDv1

    Affected: fixed in 1.4.1.

  • CVE-2024-40761Medium 5.3

    Apache Answer: Avatar URL leaked user email addresses

    Affected: fixed in 1.4.0.

  • CVE-2024-41888Medium 5.3

    Apache Answer: The link for resetting user password is not Single-Use

    Affected: fixed in 1.3.6.

  • CVE-2024-41890Medium 5.3

    Apache Answer: The link to reset the user's password will remain valid after sending a new link

    Affected: fixed in 1.3.6.

  • CVE-2024-29217Medium 4.6

    Apache Answer: XSS vulnerability when changing personal website

    Affected: fixed in 1.3.0.

  • CVE-2024-22393Critical 9.1

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    Affected: fixed in 1.2.5.

  • CVE-2024-23349Medium 5.4

    Apache Answer: XSS vulnerability when submitting summary

    Affected: fixed in 1.2.5.

  • CVE-2024-26578Medium 5.9

    Apache Answer: Repeated submission at registration created duplicate users with the same name

    Affected: fixed in 1.2.5.

  • Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.

    Affected: fixed in 1.2.1.