Login Request a demo
RA
Product
Ranger
by Apache · last CVE Aug 10, 2026
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities31In the news0Timeline
Severity mix
Critical 11High 9Medium 11Low 0
Severity
All severities31Critical11High9Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ranger to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-65945
6.5
1%
Aug 10
Apache Ranger: Logs contain replayable JWT bearer tokens
Affected: before 2.9.0
CVE-2016-6815
6.5
2%
Oct 13
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role
Affected: 0.4.0; 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.6.0; +1 more
CVE-2015-5167
6.5
2%
Apr 12
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API
Affected: through 0.5.0
CVE-2019-12397
6.1
3%
Aug 8
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue
Affected: 0.7.0 through 1.2.0
CVE-2015-0265
6.1
5%
Apr 11
Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP…
Affected: through 0.4.0
CVE-2017-7677
5.9
3%
Jun 14
In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table
Affected: through 0.7.0
CVE-2016-8746
5.9
3%
Jun 14
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true
Affected: through 0.6.2
CVE-2025-59060
5.3
0%
Mar 3
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0
Affected: before 2.8.0
CVE-2024-45478
4.8
1%
Jan 21
Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0
Affected: 2.4.0 before 2.5.0
CVE-2016-8751
4.8
2%
Jun 14
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions
Affected: before 0.6.3
CVE-2016-5395
4.8
2%
Sep 26
Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to…
Affected: through 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.6.0
Showing 11