RA
Product
Ranger
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 9Medium 11Low 0
Watch
Add Ranger to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-28672 | 9.8 | Aug 10 | Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder Affected: 0.6.0 through 2.8.0 |
| CVE-2026-32227 | 9.8 | Aug 10 | Apache Ranger: SQL Injection vulnerability in lookup functionality Affected: before 2.9.0 |
| CVE-2026-40920 | 9.8 | Aug 10 | Apache Ranger: Privilege Escalation via URL Parameter Affected: before 2.9.0 |
| CVE-2026-42537 | 9.8 | Aug 10 | Apache Ranger: Remote Code Execution via JDBC URL Injection Affected: before 2.9.0 |
| CVE-2026-44416 | 9.8 | Aug 10 | Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation Affected: before 2.9.0 |
| CVE-2026-55799 | 9.8 | Aug 10 | Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator Affected: before 2.9.0 |
| CVE-2025-59059 | 9.8 | Mar 3 | Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0 Affected: before 2.8.0 |
| CVE-2024-55532 | 9.8 | Mar 3 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0 Affected: before 2.6.0 |
| CVE-2017-7676 | 9.8 | Jun 14 | Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt Affected: through 0.7.0 |
| CVE-2016-0733 | 9.8 | Apr 12 | The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by… Affected: through 0.5.0 |
| CVE-2024-45479 | 9.1 | Jan 21 | SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0 Affected: 2.4.0 before 2.5.0 |
| CVE-2022-45048 | 8.8 | May 5 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0 Affected: 2.3.0 |
| CVE-2018-11778 | 8.8 | Oct 5 | UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow Affected: before 1.2.0 |
| CVE-2016-0735 | 8.8 | Apr 11 | Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level… Affected: 0.5.0; 0.5.1 |
| CVE-2021-40331 | 8.1 | May 5 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin Affected: 2.0.0 through 2.3.0 |
| CVE-2026-55814 | 7.5 | Aug 10 | Apache Ranger: Download APIs expose plugin data without authentication Affected: before 2.9.0 |
| CVE-2026-65942 | 7.5 | Aug 10 | Apache Ranger: Clients accept TLS certificates issued for other hostnames Affected: before 2.9.0 |
| CVE-2026-65948 | 7.3 | Aug 10 | Apache Ranger: UnixAuth lacks brute-force protection Affected: before 2.9.0 |
| CVE-2016-2174 | 7.2 | Jun 13 | SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime… Affected: 0.5.0; 0.5.1; 0.5.2 |
| CVE-2015-0266 | 7.1 | Apr 11 | The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs Affected: through 0.4.0. |
| CVE-2026-65945 | 6.5 | Aug 10 | Apache Ranger: Logs contain replayable JWT bearer tokens Affected: before 2.9.0 |
| CVE-2016-6815 | 6.5 | Oct 13 | In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role Affected: 0.4.0; 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.6.0; +1 more |
| CVE-2015-5167 | 6.5 | Apr 12 | The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API Affected: through 0.5.0 |
| CVE-2019-12397 | 6.1 | Aug 8 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue Affected: 0.7.0 through 1.2.0 |
| CVE-2015-0265 | 6.1 | Apr 11 | Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP… Affected: through 0.4.0 |
| CVE-2017-7677 | 5.9 | Jun 14 | In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table Affected: through 0.7.0 |
| CVE-2016-8746 | 5.9 | Jun 14 | Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true Affected: through 0.6.2 |
| CVE-2025-59060 | 5.3 | Mar 3 | Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0 Affected: before 2.8.0 |
| CVE-2024-45478 | 4.8 | Jan 21 | Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0 Affected: 2.4.0 before 2.5.0 |
| CVE-2016-8751 | 4.8 | Jun 14 | Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions Affected: before 0.6.3 |
| CVE-2016-5395 | 4.8 | Sep 26 | Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to… Affected: through 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.6.0 |
Showing 31