Login Request a demo
AR
Product
Apache Ranger
by Apache Software Foundation · last CVE Aug 10, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 5High 3Medium 1Low 0
Severity
All severities9Critical5High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Ranger to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-28672
9.8
3%
Aug 10
Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
Affected: 0.6 through 2.8
CVE-2026-40920
9.8
1%
Aug 10
Apache Ranger: Privilege Escalation via URL Parameter
Affected: through 2.8.0
CVE-2026-42537
9.8
1%
Aug 10
Apache Ranger: Remote Code Execution via JDBC URL Injection
Affected: through 2.8.0
CVE-2026-44416
9.8
1%
Aug 10
Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Affected: through 2.8.0
CVE-2026-55799
9.8
1%
Aug 10
Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator
Affected: through 2.8.0
CVE-2026-55814
7.5
1%
Aug 10
Apache Ranger: Download APIs expose plugin data without authentication
Affected: through 2.8.0
CVE-2026-65942
7.5
1%
Aug 10
Apache Ranger: Clients accept TLS certificates issued for other hostnames
Affected: through 2.8.0
CVE-2026-65948
7.3
1%
Aug 10
Apache Ranger: UnixAuth lacks brute-force protection
Affected: through 2.8.0
CVE-2026-65945
6.5
1%
Aug 10
Apache Ranger: Logs contain replayable JWT bearer tokens
Affected: through 2.8.0
Showing 9