| CVE-2026-70469 |
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-81866 |
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not…
|
0.5
Low
|
Sep 16, 2026 |
| CVE-2026-82561 |
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a…
|
5.9
Medium
|
Sep 16, 2026 |
| CVE-2026-86089 |
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API…
|
2.3
Low
|
Sep 16, 2026 |
| CVE-2026-68981 |
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding…
|
8.8
High
|
Aug 3, 2026 |
| CVE-2026-68980 |
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts…
|
2.3
Low
|
Aug 3, 2026 |
| CVE-2026-62354 |
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients…
|
7.7
High
|
Aug 3, 2026 |
| CVE-2026-68979 |
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization…
|
5.9
Medium
|
Aug 3, 2026 |
| CVE-2026-44914 |
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension…
|
7.5
High
|
Jun 22, 2026 |
| CVE-2026-44911 |
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows…
|
2.3
Low
|
Jun 22, 2026 |
| CVE-2026-44913 |
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through…
|
5.2
Medium
|
Jun 22, 2026 |
| CVE-2026-54665 |
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an…
|
6.3
Medium
|
Jun 22, 2026 |
| CVE-2026-39816 |
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code…
|
7.5
High
|
May 8, 2026 |
| CVE-2026-25903 |
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components…
|
8.7
High
|
Feb 17, 2026 |
| CVE-2025-66524 |
Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable…
|
7.5
High
|
Dec 19, 2025 |
| CVE-2025-27017 |
Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi…
|
6.9
Medium
|
Mar 12, 2025 |
| CVE-2024-56512 |
Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced…
|
2.1
Low
|
Dec 28, 2024 |
| CVE-2024-52067 |
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context…
|
6.9
Medium
|
Nov 21, 2024 |
| CVE-2024-45477 |
Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a…
|
4.6
Medium
|
Oct 29, 2024 |
| CVE-2024-37389 |
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context…
|
4.6
Medium
|
Jul 8, 2024 |
| CVE-2023-49145 |
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration…
|
7.9
High
|
Nov 27, 2023 |
| CVE-2023-40037 |
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with…
|
Not rated
|
Aug 18, 2023 |
| CVE-2023-36542 |
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for…
|
Not rated
|
Jul 29, 2023 |
| CVE-2023-34212 |
The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in…
|
Not rated
|
Jun 12, 2023 |
| CVE-2023-34468 |
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an…
|
Not rated
|
Jun 12, 2023 |