AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-64944

Apache Answer: cross-site scripting

Apache Software Foundation

CVE-2026-64944 · Published Oct 19, 2026 · updated Nov 3, 2026

Medium5.4
No fix yet
Apache Software Foundation advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Answer
Product
<= 2.0.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-79

More Apache Software Foundation advisories

All Apache Software Foundation
High 8.8Oct 19Apache Camel: unsafe deserializationCVE-2026-88900fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: information disclosureCVE-2026-85317fixed in 4.18.5 +1Medium 6.5Oct 19Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2...CVE-2026-85296fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: improper input validationCVE-2026-85312fixed in 4.18.5 +1Medium 4.3Oct 19Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache...CVE-2026-85313fixed in 4.18.5 +1Medium 6.5Oct 19Apache Camel: improper input validationCVE-2026-85314fixed in 4.18.5 +1