Vulnerabilidades do Apache Software Foundation Ranger
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Ranger: 12 registro(s), com versões afetadas e correções.cpe:2.3:a:apache:ranger
CVE-2026-65948
Alta · 7.3
CWE-307 10/08/2026
Improper Restriction of Excessive Authentication Attempts em Apache Software Foundation Ranger
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65945
Média · 6.5
CWE-532 10/08/2026
Insertion of Sensitive Information into Log File em Apache Software Foundation Ranger
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65942
Alta · 7.5
CWE-297 10/08/2026
TLS hostname verification issue in Apache Ranger Client Code in versions
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-55814
Alta · 7.5
CWE-306 10/08/2026
Missing Authentication for Critical Function em Apache Software Foundation Ranger
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-55799
Crítica · 9.8
CWE-94 10/08/2026
Code Injection em Apache Software Foundation Ranger
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-44416
Crítica · 9.8
CWE-94 10/08/2026
Code Injection em Apache Software Foundation Ranger
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-42537
Crítica · 9.8
CWE-20 10/08/2026
Improper Input Validation em Apache Software Foundation Ranger
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-40920
Crítica · 9.8
CWE-20 10/08/2026
Improper Input Validation em Apache Software Foundation Ranger
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-32227
Crítica · 9.8
CWE-89 10/08/2026
SQL Injection em Apache Software Foundation Ranger
SQL Injection vulnerability vulnerability in Apache Ranger.
This issue affects .
Users are recommended to upgrade to version 2.9.0, which fixes the issue.
CVE-2026-28672
Crítica · 9.8
CWE-77 10/08/2026
Command Injection em Apache Software Foundation Ranger
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.
This issue affects Apache Ranger: from 0.6 through 2.8.
CVE-2025-59060
Média · 5.3
CWE-297 03/03/2026
Apache Ranger: Hostname verification bypass in NiFiRegistryClient
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
CVE-2025-59059
Crítica · 9.8
CWE-94 03/03/2026
Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.