Apache Nifi vulnerabilities

• apache nifi Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests CVE-2026-70469 Fix available 7.5 HighSeptember 16, 2026
• apache nifi Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration CVE-2026-81866 Fix available 0.5 LowSeptember 16, 2026
• apache nifi Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods CVE-2026-82561 Fix available 5.9 MediumSeptember 16, 2026
• apache nifi Apache NiFi: Missing Process Group Authorization for Connector Migration CVE-2026-86089 Fix available 2.3 LowSeptember 16, 2026
• apache nifi, apache software foundation nifi registry +1 more Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles CVE-2026-87976 Fix available 7.2 HighSeptember 16, 2026
• apache nifi Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests CVE-2026-68981 Fix available 8.8 HighAugust 3, 2026
• apache nifi Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion CVE-2026-68980 Fix available 2.3 LowAugust 3, 2026
• apache nifi Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests CVE-2026-62354 Fix available 7.7 HighAugust 3, 2026
• apache nifi Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates CVE-2026-68979 Fix available 5.9 MediumAugust 3, 2026
• apache nifi Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents CVE-2026-44914 Fix available 7.5 HighJune 22, 2026
• apache nifi Apache NiFi: Incorrect Authorization for Configuration Verification Requests CVE-2026-44911 Fix available 2.3 LowJune 22, 2026
• apache nifi Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL CVE-2026-44913 Fix available 5.2 MediumJune 22, 2026
• apache nifi Apache NiFi: Missing Validation for Proxy Host Headers CVE-2026-54665 Fix available 6.3 MediumJune 22, 2026
• apache nifi Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService CVE-2026-39816 Public exploitFix available 7.5 HighMay 8, 2026
• apache nifi Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates CVE-2026-25903 Fix available 8.7 HighFebruary 17, 2026
• apache nifi Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor CVE-2025-66524 Fix available 7.5 HighDecember 19, 2025
• apache nifi Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record CVE-2025-27017 Fix available 6.9 MediumMarch 12, 2025
• apache nifi Apache NiFi: Missing Complete Authorization for Parameter and Service References CVE-2024-56512 Public exploitFix available 2.1 LowDecember 28, 2024
• apache nifi Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log CVE-2024-52067 Fix available 6.9 MediumNovember 21, 2024
• apache nifi Apache NiFi: Improper Neutralization of Input in Parameter Description CVE-2024-45477 Fix available 4.6 MediumOctober 29, 2024
• apache nifi Apache NiFi: Improper Neutralization of Input in Parameter Context Description CVE-2024-37389 Fix available EPSS 24.0% 4.6 MediumJuly 8, 2024
• apache nifi Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt CVE-2023-49145 Fix available 7.9 HighNovember 27, 2023
• apache software foundation nifi minifi c++, apache nifi minifi c\+\+ +1 more Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++ CVE-2023-41180 5.9 MediumSeptember 3, 2023
• apache nifi Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs CVE-2023-40037 Public exploitFix available 6.5 MediumAugust 18, 2023
• apache nifi Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources CVE-2023-36542 Public exploitFix available 8.8 HighJuly 29, 2023
• apache nifi Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components CVE-2023-34212 Public exploitFix available 6.5 MediumJune 12, 2023
• apache nifi Apache NiFi: Potential Code Injection with Database Services using H2 CVE-2023-34468 Public exploitFix available EPSS 61.9% 8.8 HighJune 12, 2023
• apache nifi Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes CVE-2023-22832 Fix available 7.5 HighFebruary 10, 2023
• apache nifi, nifi registry +1 more Improper Neutralization of Command Elements in Shell User Group Provider CVE-2022-33140 Public exploitFix available 8.8 HighJune 15, 2022
• apache nifi Improper Restriction of XML External Entity References in Multiple Components CVE-2022-29265 Fix available 7.5 HighApril 30, 2022
• apache nifi Insufficiently protected credentials CVE-2022-26850 Fix available 4.3 MediumApril 6, 2022
• apache nifi Apache NiFi information disclosure by XXE CVE-2021-44145 Fix available 6.5 MediumDecember 17, 2021
• apache nifi minifi c\+\+, apache software foundation nifi - minifi c++ +1 more MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol CVE-2021-33191 9.8 CriticalAugust 24, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache nifi +14 more +16 more DOS vulnerability for Quoted Quality CSV headers CVE-2020-27223 Public exploitFix available EPSS 78.0% 5.2 MediumFebruary 26, 2021
• fasterxml jackson-databind, apache nifi, debian linux +6 more +8 more Deserialization of untrusted data in jackson-databind CVE-2021-20190 Fix available 8.1 HighJanuary 19, 2021
• apache nifi Inadequate Encryption Strength in Apache NiFi CVE-2020-9491 Fix available 7.5 HighOctober 1, 2020
• apache nifi Improper Restriction of XML External Entity Reference in Apache NiFi CVE-2020-13940 Fix available 5.5 MediumOctober 1, 2020
• apache nifi Missing Authentication for Critical Function in Apache NiFi CVE-2020-9487 Fix available 7.5 HighOctober 1, 2020
• apache nifi Insertion of Sensitive Information into Log File in Apache NiFi Stateless CVE-2020-9486 Fix available 7.5 HighOctober 1, 2020
• apache nifi registry Insufficient Session Expiration in Apache NiFi Registry CVE-2020-9482 Fix available 6.5 MediumApril 28, 2020
• apache nifi Insertion of Sensitive Information into Log File in Apache NiFi CVE-2020-1942 Fix available 7.5 HighFebruary 11, 2020
• apache nifi Cross-site scripting in Apache NiFi CVE-2020-1933 Fix available 6.1 MediumJanuary 28, 2020
• apache nifi Apache NiFi Insertion of Sensitive Information into Log File CVE-2020-1928 Fix available 5.3 MediumJanuary 28, 2020
• apache nifi Apache NiFi process group information disclosure CVE-2019-10083 Fix available 5.3 MediumNovember 19, 2019
• apache nifi Apache NiFi user log out issue CVE-2019-12421 Fix available 8.8 HighNovember 19, 2019
• apache nifi Apache NiFi information disclosure by XXE CVE-2019-10080 Fix available 6.5 MediumNovember 19, 2019
• apache commons beanutils, nifi, debian linux +57 more +59 more Insecure Deserialization in Apache Commons Beanutils CVE-2019-10086 Fix available EPSS 29.1% 7.3 HighAugust 20, 2019
• apache nifi Cleartext Transmission of Sensitive Information in Apache nifi CVE-2018-17195 Fix available 7.5 HighDecember 19, 2018
• apache nifi Apache NiFi Improper Input Validation vulnerability CVE-2018-17194 Fix available 7.5 HighDecember 19, 2018
• apache nifi Cross site scripting in org.apache.nifi:nifi CVE-2018-17193 Fix available 6.1 MediumDecember 19, 2018
• Show olderLoading…