CVE-2026-76994

HighCVSS 7.5/10Last modified Nov 3, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
Apache Software FoundationApache Answer<= 2.0.2

References

Timeline

Published
Oct 19, 2026
Last modified
Nov 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-769954.7A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the fCVE-2026-769967.3A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fCVE-2026-769976.3A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the CVE-2026-769987.3A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown funcCVE-2026-769996.3A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_CVE-2026-77006.3A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/lCVE-2026-770009.8The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity providCVE-2026-770019.8The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisatCVE-2026-770029.8The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to autheCVE-2026-770032.7The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing useCVE-2026-770047.4A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptesCVE-2026-770059.6The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not
CVE-2026-76994: High severity, CVSS 7.5 | Vulnix