| CVE-2026-28672 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-32227 |
SQL Injection vulnerability vulnerability in Apache Ranger
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-40920 |
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-42537 |
Remote Code Execution via JDBC URL Injection in Apache…
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-44416 |
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-55799 |
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache…
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-55814 |
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-65942 |
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-65945 |
Logs contain replayable JWT tokens in Apache Ranger…
|
Not rated
|
Aug 10, 2026 |
| CVE-2026-65948 |
UnixAuth lacks brute-force protection in Apache Ranger…
|
Not rated
|
Aug 10, 2026 |
| CVE-2025-59060 |
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0
|
Not rated
|
Mar 3, 2026 |
| CVE-2025-59059 |
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0
|
Not rated
|
Mar 3, 2026 |
| CVE-2024-55532 |
Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0
|
Not rated
|
Mar 3, 2025 |
| CVE-2024-45479 |
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0
|
Not rated
|
Jan 21, 2025 |
| CVE-2024-45478 |
Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0
|
Not rated
|
Jan 21, 2025 |
| CVE-2022-45048 |
Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution…
|
8.4
High
|
May 5, 2023 |
| CVE-2019-12397 |
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue
|
Not rated
|
Aug 8, 2019 |
| CVE-2018-11778 |
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based…
|
Not rated
|
Oct 5, 2018 |
| CVE-2016-6815 |
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with…
|
Not rated
|
Oct 13, 2017 |
| CVE-2017-7677 |
In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be…
|
Not rated
|
Jun 14, 2017 |
| CVE-2017-7676 |
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test,…
|
Not rated
|
Jun 14, 2017 |
| CVE-2016-8751 |
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions
|
Not rated
|
Jun 14, 2017 |
| CVE-2016-8746 |
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain…
|
Not rated
|
Jun 14, 2017 |