CVE-2025-59060

MediumCVSS 5.3/10Last modified Aug 24, 2026

Description

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-297

Affected software

No affected versions have been published.

Timeline

Published
Mar 3, 2026
Last modified
Aug 24, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-59078.8A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code oCVE-2025-59088.8A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some CVE-2025-590888.6If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV CVE-2025-590895.9If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit CVE-2025-59098.8A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown functiCVE-2025-590909.3On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. ThereCVE-2025-590919.3Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 andCVE-2025-590928.7An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used fCVE-2025-590938.5Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived fromCVE-2025-590948.4A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within thCVE-2025-590956.8The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptCVE-2025-590964.6The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multi
CVE-2025-59060: Medium severity, CVSS 5.3 | Vulnix