AN
Product
Apache NiFi
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 11Low 0
Watch
Add Apache NiFi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25903 | 6.6 | Feb 17 | Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates Affected: 1.1.0 before 2.8.0 |
| CVE-2026-82561 | 6.5 | Sep 16 | Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods Affected: 1.5.0 through 2.11.0 |
| CVE-2025-27017 | 6.5 | Mar 12 | Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record Affected: 1.13.0 through 2.2.0 |
| CVE-2026-44911 | 6.3 | Jun 22 | Apache NiFi: Incorrect Authorization for Configuration Verification Requests Affected: 1.15.0 through 2.9.0 |
| CVE-2024-56512 | 5.4 | Dec 28 | Apache NiFi: Missing Complete Authorization for Parameter and Service References Affected: 1.10.0 through 2.0.0 |
| CVE-2024-37389 | 5.4 | Jul 8 | Apache NiFi: Improper Neutralization of Input in Parameter Context Description Affected: 1.10.0 through 1.26.0; 2.0.0-M1 through 2.0.0-M3 |
| CVE-2026-54665 | 5.3 | Jun 22 | Apache NiFi: Missing Validation for Proxy Host Headers Affected: 0.0.1 before 2.10.0 |
| CVE-2024-52067 | 4.9 | Nov 21 | Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log Affected: 1.16.0 through 1.28.0; 2.0.0-M1 through 2.0.0-M4 |
| CVE-2024-45477 | 4.6 | Oct 29 | Apache NiFi: Improper Neutralization of Input in Parameter Description Affected: 1.10.0 through 1.27.0; 2.0.0-M1 through 2.0.0-M3 |
| CVE-2026-81866 | 4.3 | Sep 16 | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration Affected: 2.9.0 through 2.11.0 |
| CVE-2026-62354 | 4.3 | Aug 3 | Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests Affected: 1.10.0 through 2.10.0 |
Showing 11