Apache Nifi vulnerabilities
59 published vulnerabilities in Apache Nifi. The most were published in 2026 (15), and 15 so far in 2026.
Apache Nifi vulnerabilities by year
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Apache Nifi vulnerabilities
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
- CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2
- CVE-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider
- CVE-2019-12421 Apache NiFi user log out issue
- CVE-2026-25903 Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
- CVE-2021-20190 Deserialization of untrusted data in jackson-databind
- CVE-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
- CVE-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.