CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

EUVD-2026-104165

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910

The Apache Answer software, versions through 2.0.2 , is vulnerable to a missing authentication for critical function vulnerability in its reaction API . The API fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted content or perfo...

CVE-2026-90910: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

PT-2026-117322

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.3 Description An authentication bypass exists in the reaction API endpoint. The system fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted...

Apache Answer authorization issue vulnerability

Versions 2.0.2 and earlier of Apache Answer contain an authorization issue vulnerability. This vulnerability stems from the reaction API’s lack of content visibility controls, which may allow unauthorized users to read restricted content in reaction metadata or to add and delete their own reactio...

PT-2026-117150

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the...

Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity

We study a protocol-level reaction leakage in CKKS deployments where public coefficient-to-slot C2S evaluation keys are combined with a client's 1-bit validity response. Under this deployment surface, a malicious evaluator can recover a ternary secret key using asymptotically optimal $OH$ reactio...

CVE-2026-27158

The WhatsApp "reaction" action validated message ownership but did not enforce the same "allowFrom" JID authorization used by other outbound send paths. In "allowFrom"-restricted setups, an authenticated caller with tool access could attempt reactions to non-allowlisted chats by providing a forge...

CVE-2026-100598

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

PT-2026-99234

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1 Description The software incorrectly binds Signal approval reactions. When unrelated outbound messages and a pending approval exist in the same conversation, a reaction intended for a structured approval...

CVE-2026-100582: Missing Authorization

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

DRUPAL-CONTRIB-2026-190

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

PT-2026-97676

Name of the Vulnerable Software and Affected Versions Drupal Smart Content versions 0.0.0 through 3.2.1 Description Missing authorization in the Smart Content Block submodule allows forceful browsing. The issue occurs when the module renders blocks of a "Display Blocks" reaction via the AJAX...

CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...