Known vulnerabilities in Apache Nifi

Software: Apache Nifi
Software CPE: cpe:2.3:a:apache_foundation:apache_nifi:*:*:*:*:*:*:*:*
Total vulnerabilities: 30
Public exploits: 4
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Nifi Apache Nifi is affected by 30 known vulnerabilities: 1 critical, 2 high, 9 medium, 18 low Critical High Medium Low

Vulnerabilities (30)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU145318 - Missing Authorization
CVE-2026-39816
CWE-862 Medium
Available
No
2.9.0 25.08.2026 SB20260825104
#VU145263 - Improper input validation
CVE-2026-54665
CWE-20 Medium
No
No
2.10.0 25.08.2026 SB2026082578
#VU145262 - Missing Authorization
CVE-2026-44914
CWE-862 Low
No
No
2.10.0 25.08.2026 SB2026082578
#VU145261 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44913
CWE-89 Low
No
No
2.10.0 25.08.2026 SB2026082578
#VU145260 - Improper Access Control
CVE-2026-44911
CWE-284 Low
No
No
2.10.0 25.08.2026 SB2026082578
#VU144807 - Resource exhaustion
CVE-2026-68981
CWE-400 Medium
No
No
2.11.0 24.08.2026 SB20260824142
#VU144806 - Improper Access Control
CVE-2026-68980
CWE-284 Low
No
No
2.11.0 24.08.2026 SB20260824142
#VU144805 - Improper Access Control
CVE-2026-62354
CWE-284 Low
No
No
2.11.0 24.08.2026 SB20260824142
#VU144804 - Incorrect Authorization
CVE-2026-68979
CWE-863 Low
No
No
2.11.0 24.08.2026 SB20260824142
#VU120246 - Deserialization of Untrusted Data
CVE-2025-66524
CWE-502 Medium
No
No
2.7.0 23.12.2025 SB2025122302
#VU107425 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-37389
CWE-79 Low
No
No
1.27.0, 2.0.0-M4 14.04.2025 SB2024071080
#VU106091 - Exposure of sensitive information to an unauthorized actor
CVE-2025-27017
CWE-200 Low
No
No
2.3.0 27.03.2025 SB2025032715
#VU101976 - Missing Authorization
CVE-2024-56512
CWE-862 Low
Available
No
2.1.0 28.12.2024 SB2024122803
#VU100765 - Information Exposure Through Log Files
CVE-2024-52067
CWE-532 Low
No
No
1.28.1, 2.0.0 21.11.2024 SB2024112111
#VU99433 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-45477
CWE-79 Low
No
No
1.28.0, 2.0.0-M4 28.10.2024 SB2024102861
#VU83536 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-49145
CWE-79 Low
No
No
1.24.0 28.11.2023 SB2023112854
#VU78807 - Permissions, Privileges, and Access Controls
CVE-2023-36542
CWE-264 Low
No
No
1.23.0 01.08.2023 SB2023080112
#VU77234 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-34468
CWE-94 Medium
Available
No
1.22.0 13.06.2023 SB2023061353
#VU77232 - Deserialization of Untrusted Data
CVE-2023-34212
CWE-502 Medium
No
No
1.22.0 13.06.2023 SB2023061353
#VU72104 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2023-22832
CWE-611 High
No
No
1.20.0 10.02.2023 SB2023021012


Showing elements 1 - 20 out of 30