Apache nifi

This hub aggregates every CVE we track for Apache nifi, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache nifi.

• CVE-2026-70469Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests7.5Sep 16, 2026
• CVE-2026-81866Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration4.3Sep 16, 2026
• CVE-2026-82561Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods6.5Sep 16, 2026
• CVE-2026-86089Apache NiFi: Missing Process Group Authorization for Connector Migration7.1Sep 16, 2026
• CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests7.5Aug 3, 2026
• CVE-2026-68980Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion9.1Aug 3, 2026
• CVE-2026-62354Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests4.3Aug 3, 2026
• CVE-2026-68979Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates9.8Aug 3, 2026
• CVE-2026-44914Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents7.2Jun 22, 2026
• CVE-2026-44911Apache NiFi: Incorrect Authorization for Configuration Verification Requests6.3Jun 22, 2026
• CVE-2026-44913Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL7.2Jun 22, 2026
• CVE-2026-54665Apache NiFi: Missing Validation for Proxy Host Headers5.3Jun 22, 2026
• CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService8.8May 8, 2026
• CVE-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates8.4Feb 17, 2026
• CVE-2025-66524Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor8.8Dec 19, 2025