Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

31 records in Ranger · all components

TI-2026-30817 CVE-2026-42537 · GHSA-4rwg-mr3v-x763

Apache Ranger: Remote Code Execution via JDBC URL Injection

Priority MEDIUM 51

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01289 Published 2026-08-10 No fix listed CWE-20
TI-2026-29575 CVE-2026-40920 · GHSA-8q3p-j6v6-5x63

Apache Ranger: Privilege Escalation via URL Parameter

Priority MEDIUM 50

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00732 Published 2026-08-10 No fix listed CWE-20
TI-2017-05312 CVE-2017-7676 · GHSA-758m-6g3q-g3hh

Improper input validation in Apache Ranger

Priority MEDIUM 49

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04198 Published 2017-06-14 Fixed in 0.7.1 CWE-20
TI-2016-00657 CVE-2016-0733 · GHSA-j84c-j8qm-g47r

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication…

Priority MEDIUM 48

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03063 Published 2016-04-12 Fixed in 0.5.1 CWE-287
TI-2018-08435 CVE-2018-11778 · GHSA-c99h-fgqm-6679

Out-of-bounds write in Apache Ranger

Priority MEDIUM 45

UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04011 Published 2018-10-05 Fixed in 1.2.0 CWE-787
TI-2022-22145 CVE-2022-45048 · GHSA-89gw-cffj-mqg9

Apache Ranger: code execution vulnerability in policy expressions

Priority MEDIUM 42

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01126 Published 2023-05-05 Fixed in 2.4.0 CWE-74
TI-2021-17404 CVE-2021-40331 · GHSA-vjr2-wpfh-5r9p

Permissions problem in the Apache Ranger Hive Plugin

Priority LOW 39

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00918 Published 2023-05-05 Fixed in 2.4.0 CWE-732
TI-2026-46981 CVE-2026-65945 · GHSA-c3hc-q36q-95g4

Apache Ranger: Logs contain replayable JWT bearer tokens

Priority LOW 36

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00637 Published 2026-08-10 No fix listed CWE-532
TI-2016-01984 CVE-2016-2174 · GHSA-4rjf-mxfm-98h5

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows…

Priority LOW 35

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/even…

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01884 Published 2016-06-13 Fixed in 0.5.3 CWE-89
TI-2019-09244 CVE-2019-12397 · GHSA-fpqp-v323-44xv

Cross-site scripting in Apache Ranger

Priority LOW 33

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02965 Published 2019-08-08 Fixed in 2.0.0 CWE-79
TI-2016-05856 CVE-2016-6815 · GHSA-vhxc-8jjq-859j

Credentials management flaw in Apache Ranger

Priority LOW 33

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02071 Published 2017-10-13 Fixed in 0.6.2 CWE-255
Load more
Open these records in search →