RA
Product
Ranger
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 9Medium 11Low 0
Watch
Add Ranger to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-45048 | 8.8 | May 5 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0 Affected: 2.3.0 |
| CVE-2018-11778 | 8.8 | Oct 5 | UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow Affected: before 1.2.0 |
| CVE-2016-0735 | 8.8 | Apr 11 | Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level… Affected: 0.5.0; 0.5.1 |
| CVE-2021-40331 | 8.1 | May 5 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin Affected: 2.0.0 through 2.3.0 |
| CVE-2026-55814 | 7.5 | Aug 10 | Apache Ranger: Download APIs expose plugin data without authentication Affected: before 2.9.0 |
| CVE-2026-65942 | 7.5 | Aug 10 | Apache Ranger: Clients accept TLS certificates issued for other hostnames Affected: before 2.9.0 |
| CVE-2026-65948 | 7.3 | Aug 10 | Apache Ranger: UnixAuth lacks brute-force protection Affected: before 2.9.0 |
| CVE-2016-2174 | 7.2 | Jun 13 | SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime… Affected: 0.5.0; 0.5.1; 0.5.2 |
| CVE-2015-0266 | 7.1 | Apr 11 | The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs Affected: through 0.4.0. |
Showing 9