Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-28672exploit | 9.8 critical | 3.0% | apache, ranger | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8. | Fri 23 Oct |
| CVE-2026-55799 | 9.8 critical | 1.0% | apache, ranger | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Sat 24 Oct |
| CVE-2026-32227 | 9.8 critical | 1.0% | apache, ranger | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. | Fri 23 Oct |
| CVE-2026-40920 | 9.8 critical | 1.0% | apache, ranger | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Fri 23 Oct |
| CVE-2026-42537 | 9.8 critical | 1.0% | apache, ranger | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Fri 23 Oct |
| CVE-2026-44416 | 9.8 critical | 1.0% | apache, ranger | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Fri 23 Oct |
| CVE-2026-55814 | 7.5 high | 1.0% | apache, ranger | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Sat 24 Oct |
| CVE-2026-65942 | 7.5 high | 1.0% | apache, ranger | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Sat 24 Oct |
| CVE-2026-65948 | 7.3 high | 1.0% | apache, ranger | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Sat 24 Oct |
| CVE-2026-65945 | 6.5 medium | 1.0% | apache, ranger | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. | Sat 24 Oct |
10 of 10
Download these 10 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.