NI
Product
Nifi
59
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 26Medium 28Low 0
Watch
Add Nifi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25903 | 6.6 | Feb 17 | Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates Affected: 1.1.0 before 2.8.0 |
| CVE-2026-82561 | 6.5 | Sep 16 | Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods Affected: 1.5.0 before 2.12.0 |
| CVE-2025-27017 | 6.5 | Mar 12 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during… Affected: 1.13.0 before 2.3.0 |
| CVE-2023-40037 | 6.5 | Aug 18 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient… Affected: 1.21.0 before 1.23.1 |
| CVE-2023-34212 | 6.5 | Jun 12 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and… Affected: 1.8.0 through 1.21.0 |
| CVE-2021-44145 | 6.5 | Dec 17 | In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal… Affected: 0.1.0 before 1.15.1 |
| CVE-2019-10080 | 6.5 | Nov 19 | The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file Affected: 1.3.0 through 1.9.2 |
| CVE-2018-17192 | 6.5 | Dec 19 | The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers Affected: 1.0.0 through 1.6.0 |
| CVE-2017-12623 | 6.5 | Oct 10 | An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack Affected: 1.0.0; 1.0.1; 1.1.0; 1.1.1; 1.1.2; 1.2.0; +1 more |
| CVE-2026-44911 | 6.3 | Jun 22 | Apache NiFi: Incorrect Authorization for Configuration Verification Requests Affected: 1.15.0 before 2.10.0 |
| CVE-2020-1933 | 6.1 | Jan 28 | A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0 Affected: 1.0.0 through 1.10.0 |
| CVE-2018-17193 | 6.1 | Dec 19 | The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack Affected: 1.0.0 through 1.7.1 |
| CVE-2017-7665 | 6.1 | Jun 12 | In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient Affected: through 0.7.3; 1.0.0; 1.0.1; 1.1.0; 1.1.1; 1.1.2; +1 more |
| CVE-2020-13940 | 5.5 | Oct 1 | In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently… Affected: 1.0.0 through 1.11.4 |
| CVE-2024-56512 | 5.4 | Dec 28 | Apache NiFi: Missing Complete Authorization for Parameter and Service References Affected: 1.10.0 before 2.1.0 |
| CVE-2024-37389 | 5.4 | Jul 8 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting Affected: 1.10.0 before 1.27.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +9 more |
| CVE-2023-49145 | 5.4 | Nov 27 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site… Affected: 0.7.0 before 1.24.0 |
| CVE-2016-8748 | 5.4 | Oct 19 | In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user Affected: through 1.0.0; 1.1.0 |
| CVE-2026-54665 | 5.3 | Jun 22 | Apache NiFi: Missing Validation for Proxy Host Headers Affected: 0.0.1 before 2.10.0 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 1.13.0 |
| CVE-2020-1928 | 5.3 | Jan 28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0 Affected: 1.10.0 |
| CVE-2019-10083 | 5.3 | Nov 19 | When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively) Affected: 1.3.0 through 1.9.2 |
| CVE-2017-15703 | 5.0 | Jan 25 | Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java… Affected: 1.0.0 through 1.4.0 |
| CVE-2024-52067 | 4.9 | Nov 21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process Affected: 1.16.0 before 1.28.1; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +11 more |
| CVE-2024-45477 | 4.6 | Oct 29 | Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site… Affected: 1.10.0 through 1.27.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-81866 | 4.3 | Sep 16 | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration Affected: 2.9.0 before 2.12.0 |
| CVE-2026-62354 | 4.3 | Aug 3 | Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests Affected: 1.10.0 before 2.11.0 |
| CVE-2022-26850 | 4.3 | Apr 6 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory Affected: 1.14.0 before 1.16.0 |
Showing 28