Apache nifi

This hub aggregates every CVE we track for Apache nifi, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache nifi.

• CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests7.5Aug 3, 2026
• CVE-2026-68980Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion9.1Aug 3, 2026
• CVE-2026-68979Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates9.8Aug 3, 2026
• CVE-2026-44914Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents7.2Jun 22, 2026
• CVE-2026-44911Apache NiFi: Incorrect Authorization for Configuration Verification Requests6.3Jun 22, 2026
• CVE-2026-44913Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL7.2Jun 22, 2026
• CVE-2026-54665Apache NiFi: Missing Validation for Proxy Host Headers5.3Jun 22, 2026
• CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService8.8May 8, 2026
• CVE-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates8.4Feb 17, 2026
• CVE-2025-66524Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor8.8Dec 19, 2025
• CVE-2025-27017Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record6.5Mar 12, 2025
• CVE-2024-56512Apache NiFi: Missing Complete Authorization for Parameter and Service References5.4Dec 28, 2024
• CVE-2024-52067Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log4.9Nov 21, 2024
• CVE-2024-45477Apache NiFi: Improper Neutralization of Input in Parameter Description4.6Oct 29, 2024
• CVE-2024-37389Apache NiFi: Improper Neutralization of Input in Parameter Context Description4.6Jul 8, 2024