Apache Software Foundation Apache Ranger

• CVE-2026-28672 Critical 9.8 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder 2.6%
• CVE-2026-32227 Critical 9.8 Apache Ranger: SQL Injection vulnerability in lookup functionality 0.7%
• CVE-2026-40920 Critical 9.8 Apache Ranger: Privilege Escalation via URL Parameter 0.7%
• CVE-2026-42537 Critical 9.8 Apache Ranger: Remote Code Execution via JDBC URL Injection 1.3%
• CVE-2026-44416 Critical 9.8 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation 1.2%
• CVE-2026-55799 Critical 9.8 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator 1.2%
• CVE-2026-55814 High 7.5 Apache Ranger: Download APIs expose plugin data without authentication 0.7%
• CVE-2026-65942 High 7.5 Apache Ranger: Clients accept TLS certificates issued for other hostnames 0.6%
• CVE-2026-65945 Medium 6.5 Apache Ranger: Logs contain replayable JWT bearer tokens 0.6%
• CVE-2026-65948 High 7.3 Apache Ranger: UnixAuth lacks brute-force protection 0.6%
• CVE-2025-59060 Medium 5.3 Apache Ranger: Hostname verification bypass in NiFiRegistryClient 0.5%
• CVE-2025-59059 Critical 9.8 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator 1.4%
• CVE-2024-55532 Critical 9.8 Apache Ranger: Improper Neutralization of Formula Elements in a CSV File 0.8%
• CVE-2024-45479 Critical 9.1 Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost 0.7%
• CVE-2024-45478 Medium 4.8 Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input 0.6%
• CVE-2022-45048 High 8.4 Apache Ranger: code execution vulnerability in policy expressions 1.1%