NI
Product
Nifi
59
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 26Medium 28Low 0
Watch
Add Nifi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 1.13.0 |
| CVE-2020-1928 | 5.3 | Jan 28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0 Affected: 1.10.0 |
| CVE-2019-10083 | 5.3 | Nov 19 | When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively) Affected: 1.3.0 through 1.9.2 |
| CVE-2017-15703 | 5.0 | Jan 25 | Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java… Affected: 1.0.0 through 1.4.0 |
| CVE-2024-52067 | 4.9 | Nov 21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process Affected: 1.16.0 before 1.28.1; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +11 more |
| CVE-2024-45477 | 4.6 | Oct 29 | Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site… Affected: 1.10.0 through 1.27.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-81866 | 4.3 | Sep 16 | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration Affected: 2.9.0 before 2.12.0 |
| CVE-2026-62354 | 4.3 | Aug 3 | Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests Affected: 1.10.0 before 2.11.0 |
| CVE-2022-26850 | 4.3 | Apr 6 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory Affected: 1.14.0 before 1.16.0 |