Threats affecting pkg:maven/org.apache.ranger/ranger

12 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 2.6%	CVE-2026-28672Apache Ranger · Command Injection Critical9.8EPSS 2.6%2026-08-10CVE Database V5CVE-2026-28672 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8. EPSS 2.6%Vulnerability Apache Software Foundation CWE-77	CVE Database V5	2026-08-10
Critical	9.8	EPSS 0.7%	CVE-2026-40920Apache Ranger · Improper Privilege Management Critical9.8EPSS 0.7%2026-08-10CVE Database V5CVE-2026-40920 Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. EPSS 0.7%Vulnerability Apache Software Foundation CWE-269	CVE Database V5	2026-08-10
Critical	9.8	EPSS 1.3%	CVE-2026-42537Apache Ranger · Code Injection Critical9.8EPSS 1.3%2026-08-10CVE Database V5CVE-2026-42537 Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. EPSS 1.3%Vulnerability Apache Software Foundation CWE-94	CVE Database V5	2026-08-10
Critical	9.8	EPSS 1.2%	CVE-2026-44416Apache Ranger · Code Injection Critical9.8EPSS 1.2%2026-08-10CVE Database V5CVE-2026-44416 Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. EPSS 1.2%Vulnerability Apache Software Foundation CWE-94	CVE Database V5	2026-08-10
Critical	9.8	EPSS 1.2%	CVE-2026-55799Apache Ranger · Code Injection Critical9.8EPSS 1.2%2026-08-10CVE Database V5CVE-2026-55799 Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. EPSS 1.2%Vulnerability Apache Software Foundation CWE-94	CVE Database V5	2026-08-10
High	7.5	EPSS 0.7%	CVE-2026-55814Apache Ranger · Missing Authentication High7.5EPSS 0.7%2026-08-10CVE Database V5CVE-2026-55814 CVE-2026-55814 is a high-severity vulnerability in Apache Ranger versions up to and including 2.8.0. It involves missing authentication in the Download APIs, allowing unauthenticated access to critical functions. The issue is fixed in version 2.9.0, and users are advised to upgrade to this version to mitigate the risk. EPSS 0.7%Vulnerability Apache Software Foundation CWE-306	CVE Database V5	2026-08-10
Medium	6.5	EPSS 0.6%	CVE-2026-65945Apache Ranger · Sensitive Data in Logs Medium6.5EPSS 0.6%2026-08-10CVE Database V5CVE-2026-65945 Apache Ranger versions up to 2.8.0 log replayable JWT tokens, exposing sensitive authentication information in logs. This vulnerability is identified as CWE-532, involving the insertion of sensitive data into log files. The issue is fixed in version 2.9.0. The CVSS score is 6.5, indicating a medium severity risk. EPSS 0.6%Vulnerability Apache Software Foundation CWE-532 #ghsa-c3hc-q36q-95g4	CVE Database V5	2026-08-10
High	7.3	EPSS 0.6%	CVE-2026-65948Apache Ranger · Improper Restriction of Excessive Authentication Attempts High7.3EPSS 0.6%2026-08-10CVE Database V5CVE-2026-65948 Apache Ranger versions up to and including 2.8.0 contain a vulnerability in the UnixAuth authentication method, which lacks protection against brute-force attacks. UnixAuth is not recommended for production use. The issue is resolved in version 2.9.0, which users are advised to upgrade to. EPSS 0.6%Vulnerability Apache Software Foundation CWE-307 #ghsa-vx4h-hjjm-mwrc	CVE Database V5	2026-08-10
Medium	5.3	EPSS 0.5%	CVE-2025-59060Apache Ranger · Improper Validation of Certificate with Host Mismatch Medium5.3EPSS 0.5%2026-03-03CVE Database V5CVE-2025-59060 Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue. EPSS 0.5%Vulnerability Apache Software Foundation CWE-297	CVE Database V5	2026-03-03
Critical	9.8	EPSS 1.4%	CVE-2025-59059Apache Ranger · Code Injection Critical9.8EPSS 1.4%2026-03-03CVE Database V5CVE-2025-59059 Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue. EPSS 1.4%Vulnerability Apache Software Foundation CWE-94	CVE Database V5	2026-03-03
Critical	9.1	EPSS 0.7%	CVE-2024-45479Apache Ranger · Server-Side Request Forgery (SSRF) Critical9.1EPSS 0.7%2025-01-21CVE Database V5CVE-2024-45479 SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue. EPSS 0.7%Vulnerability Apache Software Foundation CWE-918	CVE Database V5	2025-01-21
Medium	4.8	EPSS 0.6%	CVE-2024-45478Apache Ranger · Cross-site Scripting Medium4.8EPSS 0.6%2025-01-21CVE Database V5CVE-2024-45478 Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue. EPSS 0.6%Vulnerability Apache Software Foundation CWE-79	CVE Database V5	2025-01-21

Page 1 of 1 · 6 duplicate CVE records merged