NI
Product
Nifi
59
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 26Medium 28Low 0
Watch
Add Nifi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-39816 | 8.8 | May 8 | Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService Affected: 2.0.0 before 2.9.0 |
| CVE-2025-66524 | 8.8 | Dec 19 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and… Affected: 1.20.0 before 2.7.0; 2.7.0; 2.7.0 |
| CVE-2023-36542 | 8.8 | Jul 29 | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized… Affected: 0.0.2 through 1.22.0 |
| CVE-2023-34468 | 8.8 | Jun 12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL… Affected: 0.0.2 before 1.22.0 |
| CVE-2022-33140 | 8.8 | Jun 15 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing… Affected: 1.10.0 through 1.16.2 |
| CVE-2019-12421 | 8.8 | Nov 19 | When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side… Affected: 1.0.0 through 1.9.2 |
| CVE-2026-87976 | 8.1 | Sep 16 | Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles Affected: 0.4.0 before 2.12.0 |
| CVE-2021-20190 | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 Affected: 1.7.0 through 1.12.1 |
| CVE-2026-70469 | 7.5 | Sep 16 | Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests Affected: 2.11.0 |
| CVE-2026-68981 | 7.5 | Aug 3 | Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests Affected: 1.5.0 before 2.11.0 |
| CVE-2023-22832 | 7.5 | Feb 10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references Affected: 1.2.0 through 1.19.1 |
| CVE-2022-29265 | 7.5 | Apr 30 | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration Affected: 0.0.1 through 1.16.0 |
| CVE-2020-9491 | 7.5 | Oct 1 | In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP,… Affected: 1.0.0 through 1.11.4 |
| CVE-2020-9487 | 7.5 | Oct 1 | In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only… Affected: 1.0.0 through 1.11.4 |
| CVE-2020-9486 | 7.5 | Oct 1 | In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values Affected: 1.0.0 through 1.11.4 |
| CVE-2020-1942 | 7.5 | Feb 11 | In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values Affected: 0.0.1 through 1.11.0 |
| CVE-2018-17195 | 7.5 | Dec 19 | The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack Affected: 1.0.0 through 1.7.1 |
| CVE-2018-17194 | 7.5 | Dec 19 | When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded Affected: 1.0.0 through 1.7.1 |
| CVE-2018-1310 | 7.5 | May 23 | Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability Affected: before 1.6.0 |
| CVE-2017-12632 | 7.5 | Jan 23 | A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server Affected: through 1.4.0 |
| CVE-2017-5635 | 7.5 | Oct 19 | In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather… Affected: 0.7.0; 0.7.1; 1.1.0; 1.1.1 |
| CVE-2017-7667 | 7.5 | Jun 12 | Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin Affected: through 0.7.3; 1.0.0; 1.0.1; 1.1.0; 1.1.1; 1.1.2; +1 more |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 1.14.0; 1.15.0 |
| CVE-2026-44914 | 7.2 | Jun 22 | Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents Affected: 1.12.0 before 2.10.0 |
| CVE-2026-44913 | 7.2 | Jun 22 | Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL Affected: 1.2.0 before 2.10.0 |
| CVE-2026-86089 | 7.1 | Sep 16 | Apache NiFi: Missing Process Group Authorization for Connector Migration Affected: 2.11.0 |
Showing 26