CVE-2026-58442: Exposure of Sensitive Information to an Unauthorized Actor

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2025-15687

CVE-2025-15687 affects Open5GS up to version 2.7.6, specifically the SMF Diameter Gx Credit-Control-Answer Handler function smf_gx_cca_cb. The issue is described as a manipulation that results in a denial of service, with remote-launch potential. Public exploit exists according to the description...

CVE-2025-15687 Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service

A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smfgxccacb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may b...

CVE-2025-15687: Improper Resource Shutdown or Release

A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smfgxccacb of the component SMF Diameter Gx Credit-Control-Answer Handler. The manipulation results in denial of service. The attack can be launched remotely. The exploit has been released to the public and may b...

CVE-2026-45414

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

EUVD-2026-54230

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

CVE-2026-65554

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2026-65554

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

EUVD-2026-53982

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...

CVE-2026-60023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

CVE-2026-50749

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...

CVE-2026-48911

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

CVE-2026-60053

The Apache Answer software (through version 2.0.1 ) is vulnerable to an insufficient session expiration issue. This flaw allows administrative API keys to remain usable even after the owning administrator's account has been demoted, marked as inactive, suspended, or deleted. Consequently, unautho...

CVE-2026-60053 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-60053 Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-60053

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-60023 Apache Answer: Unauthorized disclosure of deleted or pending answer content

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

CVE-2026-60023 Apache Answer: Unauthorized disclosure of deleted or pending answer content

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing...

CVE-2026-60023

The Apache Answer software (versions through 2.0.1 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The root cause is that deleted or pending answers can be retrieved by unauthorized users via the single-answer read path if the parent question remain...