Apache Software Foundation Apache NiFi

• CVE-2026-70469 High 7.5 Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests 0.6%
• CVE-2026-81866 Low 0.5 Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration 0.6%
• CVE-2026-82561 Medium 6.5 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods 0.5%
• CVE-2026-86089 Low 2.3 Apache NiFi: Missing Process Group Authorization for Connector Migration 0.4%
• CVE-2026-68981 High 8.8 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests 0.7%
• CVE-2026-68980 Low 2.3 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion 0.5%
• CVE-2026-62354 High 7.7 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests 0.5%
• CVE-2026-68979 Medium 5.9 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates 0.8%
• CVE-2026-44914 High 7.5 Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents 0.7%
• CVE-2026-44911 Low 2.3 Apache NiFi: Incorrect Authorization for Configuration Verification Requests 0.5%
• CVE-2026-44913 Medium 5.2 Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL 0.6%
• CVE-2026-54665 Medium 6.3 Apache NiFi: Missing Validation for Proxy Host Headers 0.3%
• CVE-2026-39816 High 7.5 Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService 0.8%
• CVE-2026-25903 High 8.7 Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates 0.8%
• CVE-2025-66524 High 7.5 Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor 0.6%
• CVE-2025-27017 Medium 6.9 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record 1.2%
• CVE-2024-56512 Low 2.1 Apache NiFi: Missing Complete Authorization for Parameter and Service References 3.3%
• CVE-2024-52067 Medium 6.9 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log 0.7%
• CVE-2024-45477 Medium 4.6 Apache NiFi: Improper Neutralization of Input in Parameter Description 0.8%
• CVE-2024-37389 Medium 4.6 Apache NiFi: Improper Neutralization of Input in Parameter Context Description 24.0%
• CVE-2023-49145 High 7.9 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt 1.2%
• CVE-2023-40037 Unrated Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs 2.1%
• CVE-2023-36542 High 8.8 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources 1.9%
• CVE-2023-34212 Unrated Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components 2.4%
• CVE-2023-34468 High 8.8 Apache NiFi: Potential Code Injection with Database Services using H2 61.9%
• CVE-2023-22832 High 7.5 Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes 1.4%
• CVE-2022-33140 Unrated Improper Neutralization of Command Elements in Shell User Group Provider 3.5%
• CVE-2022-29265 Unrated Improper Restriction of XML External Entity References in Multiple Components 2.6%
• CVE-2022-26850 Unrated Insufficiently protected credentials 1.5%
• CVE-2021-44145 Unrated Apache NiFi information disclosure by XXE 1.8%
• CVE-2020-1933 Unrated A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other 2.8%
• CVE-2020-1928 Unrated An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a se 4.0%