Loading story…
Apache disclosed five vulnerabilities in Apache Answer affecting versions through 2.0.0, including a critical cross-site scripting issue tracked as CVE-2026-25688. The XSS flaw stems from insufficient sanitization of AI-generated answer content, allowing malicious script execution when users view affected pages. Apache also fixed CVE-2026-25699, an authorization bypass in timeline-related APIs that let authenticated users access deleted, private, or unapproved content and related revision history, potentially exposing personal information, and CVE-2026-25700, which left previously issued administrative tokens valid after an administrator account was suspended, deleted, or deactivated.
The same release also addressed CVE-2026-33582, a denial-of-service bug in which a specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and CVE-2026-34033, which allowed authenticated users to inject arbitrary HTML into notification emails because script-related tags were not properly neutralized. Apache said all five issues are remediated in Apache Answer 2.0.1 and advised users to upgrade, with reports credited to Sho Odagiri, Reimar Fritz, and Andy Gill of ZephrSec Ltd.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed an important-severity vulnerability affecting Apache Answer through version 2.0.0 in which previously issued admin tokens remained valid after an administrator was suspended, deleted, or deactivated. Apache recommended upgrading to version 2.0.1 to prevent continued administrative API access until token expiry.
Apache disclosed an important-severity denial-of-service vulnerability in Apache Answer through version 2.0.0. A specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and Apache said version 2.0.1 fixes the issue.
Apache disclosed an important-severity HTML content injection flaw affecting Apache Answer through version 2.0.0. The bug allowed authenticated users to inject arbitrary HTML into notification emails, and Apache recommended upgrading to version 2.0.1.
Apache disclosed an important-severity authorization bypass in timeline-related APIs affecting Apache Answer through version 2.0.0. The issue could let authenticated users access deleted, private, or unapproved content and revision history, and Apache said version 2.0.1 remediates it.
Apache disclosed a critical cross-site scripting vulnerability affecting Apache Answer through version 2.0.0. The flaw allowed malicious scripts to execute from insufficiently sanitized AI-generated response content, and Apache said version 2.0.1 fixes the issue.
GitLab patched CVE-2026-4922 on April 22, 2026 in versions 18.9.6, 18.10.4, and 18.11.1. The company said GitLab.com and GitLab Dedicated were already patched, and credited researcher ahacker1 with reporting the issue through HackerOne.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-48911**, a moderate-severity vulnerability in Apache Answer affecting versions through **2.0.1** that can let an unauthenticated attacker take over arbitrary user accounts. The flaw stems from insufficient verification of data authenticity caused by a missing authorization check in the external-login email-binding confirmation flow, allowing abuse of the existing user confirmation process. According to the disclosure, exploitation requires tricking a victim into clicking a crafted confirmation link, after which the attacker can bind access and seize the targeted account. Apache said the issue is fixed in **Apache Answer 2.0.2** and urged users to upgrade; the vulnerability was credited to researchers **tonghuaroot** and **yangxi**.
Aug 5, 2026
Apache disclosed and patched **38 vulnerabilities** in Apache Traffic Server (ATS), affecting `9.0.0` through `9.2.14` and `10.0.0` through `10.1.3`, with one Cripts framework flaw limited to the `10.0.x` line. The fixes were released in **ATS `9.2.15` and `10.1.4`**, and Apache urged users to upgrade immediately. The issues span core ATS functionality and multiple plugins, including request smuggling flaws such as malformed chunked-body handling (`CVE-2026-57834`), HTTP/2 downgrade smuggling via `Transfer-Encoding` (`CVE-2026-58150`), unsafe trailer forwarding (`CVE-2026-58153`), and header-name truncation that can enable header aliasing and policy bypass (`CVE-2026-58155`). Apache also fixed an access-control bypass caused by unanchored regex mappings (`CVE-2026-22068`), spoofing of internal metadata through untrusted `@` headers (`CVE-2026-33267`), and improper session reuse that could expose data across client connections (`CVE-2026-58157`). The advisory also covers a broad set of memory-safety and availability bugs, including a stack-based buffer overflow in redirect handling via a long `Host` header (`CVE-2026-33930`), MIME and header parsing errors (`CVE-2026-58154`), TLS/SNI handling crashes (`CVE-2026-58161`), cache deserialization flaws (`CVE-2026-58163`), remap configuration use-after-free conditions (`CVE-2026-58164`), and resource-exhaustion issues in HTTP/2 and HTTP/3 processing (`CVE-2026-65324`, `CVE-2026-58151`). Multiple plugins were also affected, including `header_rewrite`, `intercept`, `regex_remap`, `txn_box`, `ts_lua`, `prefetch`, `uri_signing`, `url_sig`, `webp_transform`, `certifier`, and `ESI`, with impacts ranging from crashes and memory corruption to SSRF amplification, path traversal, and certificate trust weaknesses. An oss-sec follow-up said some fixes were visible on the master branch but at least some had not yet been merged into the upcoming `10.2.x` stable branch.
Jul 31, 2026
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while `CVE-2026-57308` affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and `CVE-2026-62183` can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements. Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions **4.0.7** and **4.1.2** and noting that some older flaws were addressed in earlier point releases such as **4.1.1**, **4.0.6**, **4.0.4**, **4.0.3**, **3.0.16**, and **3.0.15**. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Jul 24, 2026